Print: Summary Body

MFA: Set up a Security Key (YubiKey)

Summary

This article provides instructions for setting up Multi-Factor Authentication (MFA) for your Microsoft (M365) account via a YubiKey security key. YubiKey is a physical security key which enables strong multi-factor authentication into a variety of systems. OIT recommends YubiKeys in situations where an authenticator app or passkey is not an option.

Body

YubiKey is a physical security key which enables strong multi-factor authentication into a variety of systems. Office of Information Technology recommends YubiKeys in situations where an authenticator app or passkey is not an option.

YubiKey offers an online quiz for selecting the right YubiKey for your needs at: https://www.yubico.com/quiz/

Product Quick Facts:

YubiKeys are small USB devices that are inserted into a desktop or laptop computer USB port / Lighting connector
Pressing the top or side button on the YubiKey generates and automatically enters a passcode on MFA prompts
YubiKey 5 series meet Microsoft’s Modern Authentication hardware requirements

IMPORTANT:

Before beginning the steps below, you must complete the initial set up of your YubiKey per the manufacturer's instructions at https://www.yubico.com/setup/
To set up Multi-factor Authentication (MFA) for your Microsoft account using a Yubikey (security key) in addition to other MFA methods - requires having at least one additional MFA sign-in method such as phone and/or authenticator app
Once the Yubikey is set up, you may choose to remove the phone or authenticator app from your sign-in methods. However, OIT strongly recommends that you keep one or more backup MFA methods to use if your Yubikey is lost or stolen.

Instructions

Note: These instructions assume you are using a computer and have your YubiKey ready. They also assume that you have completed the initial set up of your Yubikey per the manufacturer's instructions.

Step 1 - On your computer, go to: myaccount.microsoft.com

Step 2 - Expand My Account and click on Security Info in the left hand navigation panel.

My Account menu with Security Info marked.

Step 3 - Click Add sign-in method

Step 4 - Select Passkey (not the "Passkey in Microsoft Authenticator" option)

Passkey marked in the list of options.

Step 5 - Click Add then Next

Security key box, click "Next"

Step 6 - You will be prompted to sign into your M365 account. Use your existing MFA method to approve the sign in when asked.

Step 7 - Under Security key, select USB device for Yubikey 5C NFC (both FIPS and non FIPS).

Choose the type of security key that you have: USB device or NFC device.

Step 8 - Have your YubiKey ready. Click Next.

Have your security key ready then click Next.

Step 9 - When prompted, plug your YubiKey into the USB port, then touch the button or sensor on your YubiKey.

Step 10 - A browser pop-up should appear where you must create a YubiKey PIN. Type the PIN you want in the blank and click Next..

Note: This is a PIN that you create. Keep it safe and do not share it with anyone. If you lose or forget your YubiKey PIN, you will have to work with the YubiKey YubiKey Manager application to reset your PIN, or work with the YubiKey manufacturer directly. OIT has no access to assist with lost YubiKey PINs. This is why OIT strongly recommends you have an alternate method(s) set up for MFA.

PIN required - create a PIN and type it in the blank then click Next.

Step 11 - When prompted, touch your YubiKey again to complete the request.

touch your security key