Article Intended For

Penn State University employees, students, and other affiliates who wish to use a passkey for Microsoft MFA that is device-bound within the Microsoft Authenticator mobile app. 

Introduction

This article provides step-by-step instructions for creating a device-bound MFA passkey in the Microsoft Authenticator app. These instructions should work for both iOS and Android devices.

Things to know:

• Passkeys created in the Microsoft Authenticator app are device-bound only, meaning it is stored on the device where you create it. If you lose, break, or replace the device, it will not transfer to a replacement device. If you prefer to create a passkey that will sync across your devices, please see the following KB articles for your device type:
  
  
  • MFA: Enroll a Passkey With My iPhone or iPad (synced to Apple iCloud Passwords App)
  • MFA: Enroll a Passkey With My Android Phone or Tablet (synced to Google Password Manager)
    
    
• Using an Authenticator passkey is different than approving an Authenticator number selection push. A passkey allows you to sign in without entering your password and uses your device's Face ID, fingerprint, or PIN to verify your identity.
  
  
• You can have more than one passkey enrolled for your Penn State Account. For example, you can have an Authenticator device-bound passkey on your smartphone and also a synced passkey through your smartphone's secure enclave (Apple Passwords or Google Password Manager).

Article Body

PATH 1: If you don't already use the Microsoft Authenticator app for your Penn State Account

1. install the Microsoft Authenticator app from your device's app store
   
   
2. open the Authenticator app then select Add work or school account
   
   
   
   
3. sign in to your Penn State Account
   
   
   
   
4. on the Let's secure your account screen, select Continue
   
   
   
   
5. perform the unlock function for your device (Face ID, fingerprint, PIN)
   
   
6. on the Register your device screen, select Register
   
   
   
   
7. on the Help us keep your device secure screen, select Register
   
   
8. perform the unlock function for your device (Face ID, fingerprint, PIN)
   
   
9. select Done
   
   
   
   
10. to change your default sign-in method to your passkey, first log in to https://mysignins.microsoft.com/security-info/
    
    
11. in the Default sign-in method section, select Change
    
    
    
    
    
12. on the Change default method screen, select App based authentication or hardware token - code
    
    
    
    
13. select Confirm

PATH 2: If you already use the Microsoft Authenticator app for your Penn State Account

1. open the Authenticator app on your smartphone
   
   
2. select your Penn State Account
   
   
3. select Create a passkey
   
   
   
   NOTE: If you have not granted permission for the Authenticator app to use the unlock function for your device (Face ID, fingerprint, PIN) at a previous time, you will be prompted to allow this feature here.
   
   
4. perform the unlock function for your device (Face ID, fingerprint, PIN)
   
   
5. select Done
   
   
   
   
6. to change your default sign-in method to your passkey, first log in to https://mysignins.microsoft.com/security-info/
   
   
7. in the Default sign-in method section, select Change
   
   
   
   
   
8. on the Change default method screen, select App based authentication or hardware token - code
   
   
   
   
9. select Confirm

You can verify that the passkey was created by selecting your Penn State Account within the Authenticator app and selecting Passkey.

You can now follow the instructions in the following KB article to log into any Penn State website using your synced passkey: MFA: Sign In using a Passkey on a Smartphone or Tablet