A device's FIRST fingerprint enrollment is auto-approved; every later one (lost/new phone) needs your approval here before it can punch — this stops a shared password from silently enrolling a second phone.