Track the accounts outside your identity provider, the authenticators on each one, and the recovery codes that get you back in before a lost device becomes a lockout.