OIT Office of Information Technology
| Menu

Microsoft 365 Multi-Factor Authentication - Set Up a YubiKey (Mac)

Use these instructions to set up a YubiKey or other security key for use with Microsoft 365 multi-factor authentication (MFA) on a Mac. To access and update your current Microsoft MFA settings, use the Find and Update Your Security Info tutorial. Learn more about Microsoft MFA.


OS:
Layout:
one column
two columns

Step 1

On your Mac, open a new incognito/private Google Chrome window and go to the Microsoft 365 My Account page.

Please note: This process can only be completed in Google Chrome or Microsoft Edge.

Step 2

Log in using your IdentiKeyUsername@colorado.edu email address and IdentiKey password, then complete Microsoft MFA using your previously configured authentication method.

Please note: If you have not yet set up Microsoft Authenticator on your smartphone, you will be prompted to do so. Microsoft does not allow you to skip phone setup and go straight to using a YubiKey.

Step 3

In the left-hand menu, select My Account, Security Info, then Add sign-in method.

Step 4

Choose the option for Passkey.

Important: This option is different than selecting Passkey in Microsoft Authenticator.

Step 5

Select Next.

Step 6

You may get a prompt asking if you want to save the passkey to your iCloud Keychain. If your devices are signed into iCloud with iCloud Keychain enabled, you can select this option to store your passkey to your iCloud account. This method will work on any iOS or macOS device currently logged into your iCloud Account. 

If you choose to save the Passkey to your iCloud account, continue to step 11.

If you do not see this prompt, are not sure if you are signed into iCloud on all devices, don’t have an iCloud account, or if you don't want to use this method, select Cancel and continue to step 7.

This window may cover the Chrome prompt. Selecting Cancel only closes this window and won't stop your setup.

Step 7

Your browser will ask you where you’d like to save your Passkey. Select Use a phone, tablet, or security key.

Step 8

When prompted, insert and touch your YubiKey. Do not remove your YubiKey until the process is complete. 

Note: You can ignore the QR code and follow the instructions below for Use your security key. Simply touch the sensor on your security key to continue.

Step 9

Create a PIN for your YubiKey or, if you have used this YubiKey before, enter the PIN you already created for it.

Important: If you are creating a PIN for the first time, this PIN will be locked to the YubiKey for future use. You will need this PIN when using your YubiKey to verify your identity. 

Step 10

When prompted, touch the capacitive touch sensor again on your YubiKey to confirm.

Step 11

Enter a name to help identify your passkey. This can be anything you want, and can be helpful for unique identification if you replace your YubiKey or if you own multiple YubiKeys.

Step 12

Confirm your Passkey was created on your YubiKey.

Step 13

Verify the YubiKey (or passkey) is now included in the list of approved sign-in methods.

Step 14

To switch to using your Passkey/YubiKey for logins, sign out of the Microsoft portal and sign back in. Ensure you are in an incognito browser/private window. When prompted, select Sign in another way.

Step 15

Select the option Face, fingerprint, PIN, or Security Key.

Step 16

You may get a prompt from iCloud Keychain to use a passkey stored on your device, or on a device near you. If you stored your Passkey to iCloud Keychain in Step 6, follow the directions on the prompt to authenticate. 

If using a YubiKey, Select More Options to continue.

Step 17

Select USB Security Key, then insert and touch the sensor on your YubiKey when prompted.

Step 18

When prompted, enter your PIN, then click Continue.

Step 19

Touch the sensor on your YubiKey to confirm and complete login.