Registering a FIDO2 Security Key

Body

Overview

Fido2 security keys provide passwordless authentication to your EMU account. The security key takes the place of your password, and the PIN you set up when registering the security key acts as a 2nd verification step to satisfy MFA requirements.

EMU will provide Yubico FIDO2 keys to users whose job involves access to sensitive data and those who are in positions of leadership. Fido2 keys are intended to be used as backup authentication methods for those who also use the Microsoft Authenticator app, and as the primary method for those who do not have a phone capable of running the Microsoft Authenticator app.

Registering a security key

Follow the steps below to set up your security key. Screenshots shown represent the setup process using Google Chrome. Other browsers may differ slightly in presentation

1. Navigate to https://mysignins.microsoft.com/security-info and sign in

2. Click on the "+ Add sign-in method" button

3. Select "Security Key", and then "USB device". If you get a pop-up with a QR code or asking you to change bluetooth settings, click "Use a different device"

4. Select "Windows Hello or external security key"

5. Insert your security key into a USB port and follow on-screen instructions to activate it. Set a pin when prompted. The pin can be 4-63 characters in length, and refrain from using easily guessable numbers like 1234 or your EMU phone extension

6. Create a name for your security key

7. Repeat the steps above for any additional accounts you wish to secure with your FIDO2 key, up to 25. If you are using a Yubico FIDO2 key provided by EMU Information Systems, you can download the Yubikey Manager software to manage your PIN and reset your key.

Signing in with a security key

1. After entering your email address, click on "Sign in with a security key" instead of typing in your password:

2. Insert the key into a USB port on on your computer and enter your PIN when prompted.