Passkey Stored In YubiKey/FIDO2


illustration of a FIDO2 hardware key

This article outlines how to set up and use one of the options for multifactor authentication (MFA) at UMass Amherst. More about MFA and other authentication methods you can use 

About FIDO2 and YubiKeys

Recommended for people who want strong security without using a smartphone. Use a physical key and a PIN to finish logging in.  

FIDO (Fast Identity Online) 2 is a protocol that enables phishing-resistant, passwordless multifactor authentication (MFA). YubiKey is a hardware device made by Yubico which allows you to protect and access accounts using FIDO2 with a physical key.  

Note: UMass Amherst Information Technology (IT) does not provide direct support for YubiKey devices. For help with YubiKey, see Yubico Support. For help with your UMass Amherst account, and other IT supported services, contact the IT Service Desk.  

 

Set Up YubiKey For Your UMass Amherst Account 

On Windows Computers

Note: You may encounter errors when completing this process in some web browsers or in a private/Incognito window. Follow the steps below using Firefox, Chrome, or Edge.

  1. Go to mysignins.microsoft.com/security-info 
  2. Click Add sign-in method. 
  3. Select Passkey.
  4. If you see a Set up Windows Hello to save your passkey dialog, click Try using another device.  
    If you see the Sign in faster with your face, fingerprint, or PIN screen, click Next.
    If you see the Setting up your passkey screen, click Next.
  5. Once the Windows Security Save Your Passkey or the Windows Security Setting Up Your Passkey dialog is displayed, make sure you see This will be saved to your security key at the bottom of the window.
    If not, click Change.
  6. Insert your YubiKey into your computer’s usb port.
  7. When prompted, touch the button on your YubiKey.
  8. On the Save your passkey screen, enter a security PIN code for this key. Make sure it’s something you can remember. You can write this pin down in a password manager.
    Click OK.
  9. When prompted, touch the button on your YubiKey. 
  10. In your web browser, on the Let’s name your passkey dialog, enter a name that will help you identify this option later.
  11. Click Next and then Done.
On Mac OS Computers

Note: You may encounter errors when completing this process in some web browsers including Safari and Firefox, or in a private/Incognito window. Follow the steps below using Chrome or Edge.

  1. Go to mysignins.microsoft.com/security-info 
  2. Click Add sign-in method. 
  3. Select Passkey.
  4. On the Sign in faster with your face, fingerprint, or PIN screen, click Next. 
  5. On the Setting up your passkey... screen, click Next.
  6. If you are prompted to enable iCloud Keychain click More options. 
    If you are prompted to Use your security key with login.microsoft.com, continue to the next step.
  7. Insert your YubiKey into the computer’s usb port. 
    If prompted to Allow accessory to connect, click Allow. 
    The first time you use your YubiKey on a Mac OS computer, you may be prompted with a Keyboard Setup Assistant dialog. Click the red X button in the upper left corner of the window or the Quit button.
  8. When prompted, touch the button on your YubiKey.
  9. On the PIN required dialog, enter a security PIN code for this key. Make sure it’s something you can remember. You can write this pin down in a password manager. 
    Click Next or OK. 
  10. When prompted, touch the button on your YubiKey. 
  11. In your web browser, on the Let’s name your passkey dialog, enter a name that will help you identify this option later.
  12. Click Next and then Done. 

 

Log In Using Your YubiKey 

Once you have set up a YubiKey, you can use it to authenticate while logging into UMass Amherst services. For example, while logging into SPIRE:  

  1. Go to spire.umass.edu and click Log in to SPIRE. 
  2. Enter your NetID email [NetID]@umass.edu and click Next. 
  3. If prompted, select Use Security Key.
  4. Insert your YubiKey into your computer’s USB port and touch the button on your YubiKey.
  5. Enter your security PIN, click Next or Continue if prompted, then touch the button on your YubiKey again.
  6. If you are using a computer only you access, click Yes to Stay signed in. Do not use this option on public or shared computers. 

 

Add, Change, or Remove Multifactor Authentication Options 

Go to mysignins.microsoft.com/security-info to add or delete authentication methods and to set a default option.