Article Intended For

Penn State University employees, students, and other affiliates who wish to use a passkey for Microsoft MFA that is stored (device-bound) on a FIDO2 Security Key.

Introduction

This article provides step-by-step instructions for creating a device-bound passkey stored on a FIDO2 security key.

Things to know:

• Penn State uses Microsoft Entra as a sign on platform. You can purchase any FIDO2 security key that is listed on the following website: Microsoft Entra ID attestation for passkey (FIDO2) vendors
  
  
• If a key is not listed on the website above, it will not work with your Penn State Account.
  
  
• FIDO2 security keys can be purchased from many major retailers, including Amazon, Best Buy, and Walmart.
  
  
• Ensure that your device (laptop computer, desktop computer, smartphone, tablet) has the correct type of USB port for the key you want to purchase. For example, if your laptop does not have a USB-C port, do not purchase a USB-C type key. Instead, purchase a USB-A type key.
  
  
• Most modern smartphones utilize USB-C. If you plan to frequently log into your Penn State Account directly on your phone, purchase a USB-C type key or a key that supports NFC. NFC allows you to tap the key on your phone without inserting it into a USB slot. If you want to utilize NFC and are unsure if your phone supports this technology, you will need to contact your smartphone manufacturer.
  
  
• Due to the large number of possible keys that can be obtained, Penn State can assist with issues regarding Yubico brand security keys (Yubikeys). For issues with other brands, you will need to contact the manufacturer directly for assistance. Please understand that Penn State cannot assist with a malfunctioning Yubikey, and you may be directed to Yubico for assistance in those instances if basic troubleshooting does not work.
  
  

For more detailed information, including supported browser versions, see the following KB article: MFA: Requirements for Using a Security Key for Multifactor Authentication

Article Body

1. sign in to https://mysignins.microsoft.com/security-info using your Penn State Account credentials
   
   
2. select +Add sign-in method
   
   
   
   
3. select Passkey
   
   
   
   
4. select Next
   
   
   
   
5. If you already have a passkey enrolled, you will see the following screen and will need to select Change.
   
   If you don't encounter this screen, continue to step 6.
   
   
   
   
6. select Security Key
   
   
   
   
7. insert your FIDO2 security key into an available USB slot on your computer or laptop (which slot you choose depends on whether you have a USB-A or USB-C type of security key)
   
   
8. type a PIN, then type the same PIN to confirm it, then select OK
   
   
   
   
9. physically tap or touch the button located on your security key
   
   
   
   
10. type a name for your security key
    
    
    
    
11. select Next
    
    
12. on the confirmation screen that your passkey was created successfully, select Done
    
    
    
    You will now see your FIDO2 security key listed in your available devices along with the name you chose to associate with it.
    
    
    
    
13. to change your default sign-in method to your passkey, in the Default sign-in method section, select Change
    
    
    
    
14. on the Change default method screen, select App based authentication or hardware token - code
    
    
    
    
15. select Confirm
    

You can now follow the instructions in the following KB article to log into any Penn State website using your FIDO2 security key: MFA: Sign In Using a Passkey on a FIDO2 Security Key