Security key (YubiKey)

[Translate to Englisch:] USB STick und Laptop

The security key is a hardware-based authentication solution that supports multiple authentication protocols (e.g., FIDO2) and secure login to your university account.

The major advantage: The security key enables passwordless login with enhanced security and multi-factor authentication.

Employees of the University of Passau are provided with a security key. This is the YubiKey 5 NFC model from the manufacturer Yubico.

Students have the option of purchasing a YubiKey or another Microsoft-compatible FIDO2 security key from a retailer and using it for login. In Germany, YubiKeys can be ordered directly from the official Yubico-Shop, for example. Other Microsoft-compatible FIDO2 security keys can also be used. An overview of supported providers can be found under "Providers of Microsoft-compatible FIDO2 security keys".

If you wish to set up this MFA method, you must already have an existing, working MFA method (e.g., Microsoft Authenticator-app, TOTP-app or SMS-method) during the setup process. Otherwise, it is not possible to register this method correctly.

Furnish

During the security key setup process, you will need to confirm the registration using an existing MFA method. Therefore, please ensure that you have already registered another MFA method for your university account before setting up the security key. We recommend the Microsoft Authenticator-app.

Step 1 – Registration on the security portal

Open the Microsoft portal: https://aka.ms/mysecurityinfo
Sign in with your Microsoft University account.

Step 2 – Adding a new security method

Select "Add method".
Click on “Security Key” in the selection menu.

Step 3 – Selecting the key type

Select USB device.

Step 4 – Registering the security key with PIN setupSchritt 4 – Registrierung des Sicherheitsschlüssels mit PIN-Einrichtung

Insert the security key into the USB port.
You will be prompted to create a PIN.
- Requirement: At least 4 digits, 6-8 characters (numbers and possibly letters) are recommended.
- This PIN will be requested every time the security key is used subsequently.
Touch the security key at the point with the golden circle as soon as the LED flashes to confirm the registration process.

Step 5 – Naming

Give your security key a meaningful name.

Step 6 – Conclusion

Confirm the setup.
The security key is now stored as an authentication method in the Microsoft account.

1. View security information

Sign in to the Microsoft portal: https://aka.ms/mysecurityinfo.
Select "Security Information" in the left navigation.
Click on "Add login method".

2. Select a new login method

Select “Security Key”.

3. Select security key type

Select USB device.

4. Have your security key ready

You will be asked to have your security key ready.

Click "Next".

5. Select storage location

Select “Security Key” and click “Next”.

6. Confirm setup

A security message will appear – confirm with “OK”.

7. Continue Setup

Explanation of creating an entry on the security key.

Confirm again with "OK".

8. Insert the security key

You will be prompted to insert the security key.

Depending on the type of security key you have, use the USB-A or USB-C port on your computer. You can also connect the security key to a docking station or via an adapter.

Once you have inserted the security key correctly, it will be automatically recognized and the prompt will disappear. You can then proceed to step 9.

[Translate to Englisch:] Sicherheitsschlüssel einstecken

9. Set a PIN

Set a new PIN for your security key and confirm it. A PIN of at least 4 digits (6–8 characters of numbers and optionally letters are recommended) will be required each time you use the YubiKey.

10. Touch the security key

Now touch the sensor on your security key – the golden circle – to complete the process.

[Translate to Englisch:] Sicherheitsschlüssel berühren

11. Confirmation

The security key has been saved. Click "OK".

12. Name the key

Give the security key a name (e.g., "YubiKey Uni-Account") and click "Next".

13. Completion message

Microsoft confirms that the security key has been set up.

Click "Done".

14. Check in the security settings

The security key now appears as a method in your security settings.

The setup is now complete, and the security key can be used to log in.

Register

To log in to your work computer or university services with your security key, you must have successfully linked the security key to your Microsoft account.

To use the security key, insert it into the device you are logging in from during the login process. Depending on your security key model, use the appropriate USB-A or USB-C port. The connection can also be made via a docking station or adapter.

When logging in via smartphone, the security key can be used via NFC in addition to the USB-C connection. If using NFC, please ensure that the NFC function is enabled on your smartphone.

Step 1: Insert the security key and select it as your login method

Insert your security key into your work device.

Depending on the type of security key you have, use the USB-A or USB-C port on your computer. You can also connect the security key to a docking station or via an adapter.

If the "Security Key" login method is not immediately displayed after inserting the security key, select "Login options" on the Windows login screen.

[Translate to Englisch:] Yubikey Rechner Schritt 1 Anmeldung

Step 2: Select the security key as your login method

Depending on which login methods are set up for your university account, you will see several login options.

Select the key icon here to use the security key.

[Translate to Englisch:] Yubikey Rechner Schritt 2 Anmeldung

Step 3: Enter PIN

Enter the PIN you set for the security key.

Confirm your entry.

[Translate to Englisch:] Yubikey Rechner Schritt 3 Anmeldung

Step 4: Touch the security key

Tap your security key at the point with the gold circle to confirm the login. You will then be automatically logged in.

[Translate to Englisch:] Yubikey Rechner Schriit 4 Berühren Anmelden

Step 1: Open the registration page

Access the university service you wish to register for or visit the following page: https://login.microsoftonline.com
If your account is already cached in your browser, skip to step 3 in the instructions.

Step 2: Open the login page. - If your account is not yet saved in your browser.

Click on "Login Options".

Step 3: Select your security key.

Choose the option: “Face recognition, fingerprint, PIN, or security key”.

Step 4: Select Security Key as the Method

Make sure your security key is plugged into the device you want to log in from. Depending on the type of security key, use the USB-A or USB-C port on your computer. You can also connect the security key to a docking station or via an adapter.
In the next window, select "Security Key".
Click "Next".

Step 5: Enter PIN

Enter your PIN for the security key.
Click "OK".

Step 6: Touch the security key

Touch your security key at the point with the gold circle to confirm your login.

You will then be automatically logged in.

[Translate to Englisch:] Yubikey berühren

Change security key PIN

Please note: You can only change your PIN if you still know the existing PIN for the security key. If you no longer know your PIN, you will need to reset the security key and set it up again.

Step 1: Open the Start menu and type "Settings".

Click the "Settings" icon.

Step 2: In the left-hand menu, click on “Accounts” and then on “Login options”.

Step 3: Scroll down to "Security Key" and click "Manage".

Step 4: Plug the security key into the USB port of your work device.

Step 5: Touch your security key at the point with the golden circle to activate it.

Step 6: Click on “Change” to change the PIN of the security key.

Step 7: Enter your current PIN in the first field at the top.

Choose a new PIN of at least 4 digits (6–8 characters, including numbers and optionally letters, are recommended). This PIN will be required each time you use the security key.

Confirm the new PIN by entering it twice.

Confirm with "OK". You have successfully changed your PIN.

Reset security key and delete as login method

You should reset your security key if:

You have forgotten your PIN,
You want to set up the security key again,
You are returning the security key,
You have tried to enter an incorrect PIN several times and the security key is now locked,
You want to delete all saved login information.

Resetting the key will delete all existing configurations, so you will need to relink it to your university account afterward.

Warning: After resetting, all saved data will be permanently lost and cannot be recovered.

Warnung: Nach dem Zurücksetzen sind alle gespeicherten Daten dauerhaft verloren und können nicht wiederhergestellt werden.

Step 1: Open the Start menu and type "Settings". Click on the "Settings" icon.

Step 2: In the left-hand menu, click on “Accounts” and then on “Login options”.

Step 3: Scroll down to "Security Key" and click "Manage".

Step 4: Plug the security key into the USB port of your work device.

Step 5: Touch your security key at the point with the golden circle to activate it.

Step 6: Click on “Reset” to reset the security key to factory settings.

Step 7: Confirm the warning message with "Continue". All data will be deleted.

Step 8: Reinsert the security key when prompted.

Step 9: Touch the security key twice within 10 seconds.

Step 10: The reset is complete. Click "Done" to finish the process.

The security key has now been reset, and you can no longer log in to your university account with it.

Step 11: Now remove the security key as a sign-in method from your Microsoft account.

Click "Delete" next to the security key you want to remove.

After deletion, Microsoft will also remove the link between the security key and your university account. You can now relink the security key to your Microsoft account and set a new PIN.

[Translate to Englisch:] Sicherheitsschlüssel löschen

Note: Not all applications support login with a security key (YubiKey).

Loginemail apps with a YubiKey (security key) is not currently supported by all apps. In particular, email appsdo not currently recognize the security key as a login method, even if it has been set as the default. These include:

Outlook app on Android devices
Thunderbird desktop app
Apple Mail on MacBook
Evolution Client
Samsung Mail

For these applications, please use a configured authenticator app for multi-factor authentication (MFA) instead.