The best way to enable your Chief Executive Officer to bypass MFA immediately and not delay his work is to select the MFA Unlock action for him through the Admin Portal. This allows an administrator to temporarily bypass the multi-factor authentication requirement, giving the user access while they resolve the issue with their lost phone. Adding a security question, configuring an on-device authenticator, or changing the phone PIN will not provide the immediate access needed in this situation.