Short answer: A lost card is revoked in two places: your access control system, and every service where it was registered as a passkey. When a replacement card is issued – enrolment, credentials and registrations do not carry over.
Why the card cannot be used by someone else
Both door access and sign-in are gated by the enrolled fingerprint, so the card cannot be used by whoever finds it. Revoke it regardless: revocation is quick and certain.
Revoke the door credentials
Block or remove the card's credentials in your access control system. Block every credential the card has registered there – some deployments register more than one.
Remove the passkeys
Remove the card from each service it was registered with. For Microsoft Entra ID, the user opens mysignins.microsoft.com, goes to Security info and deletes the passkey; an administrator can also remove it from the user's authentication methods. For other services, remove the card from the user's registered authenticators.
Passkeys are per-service. Check every service the user registered the card with, not only the main one.
Replace
Issue a replacement through your normal route, then treat it as a brand-new card, in this order: encode the door credentials, set the PIN, enrol the fingerprints, register passkeys, and grant permissions in your access control system. The keys reside in the card's secure element, so nothing transfers from the old card to the new one – that is by design.
If the card turns up again
A card that reappears after revocation has no working access until it is set up again. Decide whether to re-issue it or dispose of it securely; do not return it to use without setting it up again.