YubiKey: Mac setup instructions for multifactor authentication

Note: A Microsoft passkey is the designated MFA method for faculty, staff, and student workers. 

The YubiKey security key is an alternative MFA method for those who are unable to use passkey for multifactor authentication, such as those without the required phone OS or Bluetooth. After registration, your YubiKey can be used with multiple devices to log into university services. It is recommended that you purchase a second YubiKey as a backup in case your YubiKey is lost or damaged. 

Note: These instructions are for Mac computers. Instructions for Windows setup, as well as other YubiKey information, can be found in our YubiKey security key for multifactor authentication article. 

Before You Start

• Recommended Browser: For the best experience when registering a new YubiKey, use Microsoft Edge. Safari is supported but requires additional setup before registration. Firefox and other Firefox-based browsers may not detect a new YubiKey during registration and are not recommended for setup.

• Safari Users: Before registering a YubiKey, open System Settings > General > AutoFill & Passwords and verify that AutoFill Passwords and Passkeys is enabled. Under AutoFill From, you must select at least one option. If this setting is not enabled, Safari may fail during YubiKey registration.

Step 1: Request a YubiKey

Use the YubiKey Request form to request a YubiKey.

Step 2: Register the YubiKey 

Note: If the registration process times out, restart the registration process at “click +Add sign-in method”. Some steps may be skipped if you had already completed them before the time-out.

1. Go to: account.uark.edu
    
2. Under My Account, select Security Info.
   
   
    
3. On the Security Info page, click +Add sign-in method.
   
   
    
4. Add a sign-in method by selecting the Passkey option from the list.
   
   
    
5. Click Next.
   
   
    
6. When prompted to create a passkey, select Save Another Way. 
   
   
   
    
7. Select USB Security Key to choose how you would like to sign in.
   
   
    
8. You will be prompted to insert and touch your security key. Tap the circle on your YubiKey once it is inserted.
   
   
    
9. Create a new PIN; type the PIN in the New PIN field.
   IMPORTANT: Don't share your PIN or choose an easy-to-guess number. Your PIN protects access to your device, passkeys, and other sensitive information, so it should be safeguarded just as carefully as a password.
   
   


10. Confirm your PIN; type your new PIN again in the New PIN field.
    
    
     
11. You may be asked to touch the YubiKey once more at this point. 
12. Choose a name for the YubiKey. This is to help you identify it among other sign-in methods. Common names are "UARK YubiKey" or "My YubiKey" 
    
    
     

Safari Troubleshooting: If Safari displays a message indicating that your session may have expired or that private browsing may be enabled, verify that AutoFill Passwords and Passkeys is enabled and that at least one option is selected under AutoFill From in System Settings > General > AutoFill & Passwords. Then restart the registration process from +Add sign-in method.

Note: If you continue to experience issues, navigate to the Security Info page and select "Sign out everywhere" at the bottom. Then, continue with the instructions.

Step 3: Confirm the YubiKey

Before enrolling in the required group, you must make sure that the YubiKey was successfully added. This is important to keep you from getting locked out. 

1.  Go to the My Account page and sign in with your new YubiKey. 

2. Under My Account, select the Security Info tab. This will show you a list of the sign-in methods that you have set up. Make sure your YubiKey was added by looking for: "Passkey (Device Bound) with the name you assigned your YubiKey beside it. If you do not see this option, the YubiKey was not added correctly. Return to Step 2 to try adding the YubiKey again.
   
   View the detailed guide below for a step-by-step demonstration on confirming your YubiKey:

Step 4: Enroll in MFA with Passkey in Microsoft Authenticator group

After setting up and confirming the YubiKey, you will need to self-enroll in the Required Passkey group. 

1. After confirming that the YubiKey is in your list, select My Access in the left navigation pane.

2. Under My Access in the left navigation, Select Access Packages.
   
   
    
3. Select View All.
   
   
    
4. Choose Request in the "MFA with Passkey in Microsoft Authenticator" row.
   
   
    
5. Select Continue when the window opens.
   
   
    
6. Before enrolling in this group, answer the questions in the Additional Questions window:
   1. Select Yes or No to answer, "Have you registered a Microsoft passkey in Microsoft Authenticator or registered a YubiKey?"
   2. Select Yes or No to answer, "For Windows users, have you set up Windows Hello for Business?"
   3. You can leave the Business Justification field blank.
   4. Click the Submit Request button. 
      
      

A green message in the upper-left corner confirms your request was submitted. This will not take long to process.

You will receive an email to your UARK email account from Microsoft Security with the subject line, "You now have access to MFA with Passkey in Microsoft Authenticator" to let you know that you have successfully enrolled in the required security group. All steps are complete, and you are ready to use your YubiKey to access university resources. 

Troubleshooting NFC with YubiKeys and Security Keys