Microsoft passkey for multi-factor authentication

Passkey overview

Passkeys offer a high level of security as they are URL, device, and user specific, making them highly resistant to phishing attacks. University faculty, staff, and students should create a Microsoft passkey in Microsoft Authenticator on their mobile device (typically a cell phone) to use as a multi-factor authentication (MFA) method to authenticate when accessing university resources.
For more information, see What are passkeys?

Who is required to use a Microsoft passkey as their MFA method?

May 29, 2026: All university IT staff will be required to set up a Microsoft passkey and enroll in the passkey group.

April, 2027: All faculty, staff, and student employees will be required to set up a passkey and enroll in the passkey group.

After these dates, faculty, staff, and student employees will no longer be able to authenticate using MS Authenticator and will be required to use a passkey to authenticate when accessing university resources.

Students are also strongly encouraged to set a Microsoft passkey as their MFA method.
 

All university faculty, staff, and students are encouraged to set up passkey now!

Faculty, staff, or student employees who are unable to use a passkey may request a YubiKey to use as their MFA method. 

Device requirements

To create and use passkeys, mobile devices must meet the following minimum software requirements:

• Android 14 and later or iOS 17 and later.
• Bluetooth must be enabled on both devices.

Multi-Factor Authentication Policy (UITS)

Step 1: Set up Windows Hello

Windows Hello must be set up on any Windows device (such as your laptop or desktop computer) with which you will be using your passkey to log into university services and resources. 

Check to see if Windows Hello is already set up

Check to confirm that Windows Hello is set up on the device that you will be using to access university resources.

Step 2: Set up Microsoft Authenticator

You will create your passkey with Microsoft Authenticator so it must be installed on your mobile device (typically your personal cell phone) and configured for your UARK account before you set up the passkey. If you do not have Microsoft Authenticator installed, see our MS Authenticator Setup Instructions. 

Step 3: Create a Microsoft passkey with Authenticator

You will create the passkey on your mobile device (typically your cell phone) and then use your mobile device to supply the passkey when logging into a university system on another (or the same) device. 

1. Open the Microsoft Authenticator app on your device (typically your personal cell phone).
    
2. Tap your University of Arkansas account.
   
   
    
3. Select Create a passkey.
   
   
    
4. Tap Sign In on the Let's create your passkey screen. 
   Note: You may be required to use Microsoft Authenticator to authenticate. 
    
5. You will be required to authenticate on your mobile device at this time. 
   Enter your mobile device passcode, or if Touch ID has been set up on your mobile device, you may be prompted to authenticate with touch. (This could vary depending on your mobile device authentication method.)
   Note: If you have not set a screen lock on your device, you will be prompted  at this time to open your device Settings and set a screen lock.
    
6. Click Done in the Passkey Created screen, and you will have successfully set up your passkey. 
    
7. In your device Settings, confirm that AutoFill Passwords and Passkeys is turned on and that Authenticator is selected.
   • On an iOS 18 device, go to Settings, General, AutoFill & Passwords.
   • On an iOS 17 device, go to Settings, Passwords, Password Options.
   • On an Android device, go to Settings, Passwords & Accounts, and under the Additional providers section, make sure Authenticator is enabled.

Step 4: Sign out of everything

1. Log into the Security info page.
   Note: You might be required to authenticate using your new passkey (see Step 6). 
    
2. Click the Sign out everywhere link at the bottom of the page.
   
   
    
3. Click OK on the "Sign out everywhere?" window. 
   
   
    
4. Click your account in the Pick an account window. 
   
   

Your account will be signed out of all university resources. 

Step 5: Enroll in Required Passkey group

After setting up your passkey, you will need to self-enroll in the Required Passkey group. 

1. Log into your Microsoft My Access page.
   Note: You might be required to authenticate using your new passkey (see Step 6). 
    
2. Click Access packages from the My Access section in the left navigation.
   
   
    
3. Click View all.
   
   
    
4. Click Request in the "MFA with Passkey in Microsoft Authenticator" row.
   
   
    
5. Click Continue in the MFA with Passkey in Microsoft Authenticator window that opens. 
   
   
    
6. In the Additional questions window that opens:
   1. Select Yes or No to answer, "Have you registered a Microsoft passkey in Microsoft Authenticator or registered a YubiKey?"
   2. Select Yes or No to answer, "For Windows users, have you set up Windows Hello for Business?"
   3. Click the Submit Request button.
      The Business Justification field does not need to be completed. 
      
      
      You should see a green pop-up in the upper, left corner that lets you know that your request is being processed. 
      
      
       

You will receive an email to your UARK email account with the subject line, "You now have access to MFA with Passkey in Microsoft Authenticator" to let you know that you have successfully enrolled in the Required Passkey group.

Step 6: Use your Microsoft passkey to sign in

Signing into a university system on a computer or other device that does not hold the passkey

1. Use a browser to sign in to a university resource such as the UARK Help Portal or your Microsoft My Access page.
    
2. Click on your account from the Pick an account screen.
   
   
    
3. Click Sign-in options from the Sign in screen,
   or
   click into the username field, select your email address from the dropdown, and click Next. 

   or

4. If you selected Sign-in options, you will then select Face, fingerprint, PIN or security key from the Sign-in options screen.
   Note: Sign-in options may vary; this screen might look different or not appear, and you will go on to the next step.
   
   
    
5. Select iPhone, iPad, or Android device from the Choose a passkey screen.
   Note: Your choices could include other options than shown here.
   
   
    
6. A QR code will be displayed on the computer screen. Use your mobile device with passkey to scan the QR code.
   
   
   
   Note: When logging in, you may be asked for your passkey PIN instead of scanning a QR code. If you prefer to use the QR code (or if you are presented with the QR code, but prefer to use your PIN), click the link to choose a different passkey or sign in another way.
    
7. Click Use Passkey on the Sign In screen. 
   
   
    
8. You will be required to authenticate on your mobile device at this time. Enter your mobile device passcode, or if Touch ID has been set up on your mobile device, you may be prompted to authenticate with touch. (This could vary depending on your mobile device authentication method.)

Signing into a university system on the phone that holds the passkey

Note: Instructions may vary slightly with different browser apps.
Note: When signing in with a passkey on an iPhone, use Safari, Chrome, or Firefox. Passkey sign‑in may not work when accessing university systems from the Google app or other in‑app browsers.

1. Sign into a university resource (such as the UARK Help Portal or your Microsoft My Access page) on your phone (or other mobile device) on which you have set your passkey.
2. Select your account (username@uark.edu) in the Pick an account screen.
   Note: This step may not appear depending on which browser you are using.
3. Tap Next on the Face, fingerprint, PIN or security key screen.
   Note: This step may not appear depending on which browser you are using.
4. In the Sign In screen, tap the Use Passkey button. 
5. Tap the Sign-in options button. 
   Note: Some browsers may not have this step.
6. Authenticate for your phone. 

Unlocking your computer’s locked screen

Windows Hello allows the use of your passkey PIN to log onto your computer. You may also continue to use your UARK account password to log on.

Troubleshooting

• You experience difficulties in creating your passkey, setting up Windows Hello, signing out of everything, or enrolling in the required passkey group.
• If you are unable to log into university resources using your passkey.
• Your mobile device (phone) with your passkey is lost or broken.
• You get a new device (phone) and need to set up your passkey on your new device.

For troubleshooting alternate setup scenarios, see Microsoft’s Register passkeys in Authenticator on Android or iOS devices page.

For more information on signing in with a passkey, see Microsoft’s Sign in with passkeys in Authenticator for Android and iOS devices page.