Audience: Students, Faculty, Staff, Public
Responsible Group: IT Training and Outreach
Overview
Windows Hello, passkeys in Microsoft Authenticator, and YubiKeys all help verify your identity, but they are set up separately and are used in different situations.
On your university-owned Windows computer, you will typically use your Windows Hello PIN to sign in to both the computer and university resources. When you are using a personal (any non-university owned computer) or shared computer, you may need to use the passkey stored in Microsoft Authenticator on your mobile device or a YubiKey instead. If you use a Mac computer, you will only use the passkey stored in Microsoft Authenticator or a YubiKey.
Important: Having Windows Hello set up does not mean you have set up your passkey in Microsoft Authenticator or on a YubiKey. These require a separate setup; Windows Hello should be set up first. See the Related Articles section on the right-hand side of this article for instructions on how to set up Windows Hello, a passkey in the Microsoft Authenticator app, and a YubiKey.
When Will I Use Each One?
Windows Hello: Your Own Windows Computer
Windows Hello is set up on your Windows computer, and allows you to verify your identity with a PIN, fingerprint, or facial recognition. Most people on campus set up a PIN.
You may use Windows Hello when:
- Signing in to your Windows computer that is owned by the university.
- Authenticating into university resources from that computer.
- You are prompted for your Windows Hello PIN, fingerprint, or face.
Passkey in Microsoft Authenticator: Other or Shared Computers
A passkey is a passwordless credential used to verify your identity when signing in to university resources. A passkey is stored on your mobile device in the Microsoft Authenticator app.
You may use your Microsoft Authenticator passkey when:
- You are signing into your account on a computer or device that is not assigned to you. When using another computer, you can select the passkey sign-in option, scan the QR code displayed on the computer with your mobile device, and authenticate on your phone using the Microsoft Authenticator app.
- You are using a Mac computer.
YubiKey: Physical Security Key
YubiKeys also store passkeys, just in a different place. Instead of the Microsoft Authenticator App on your mobile device, the passkey is stored on a physical security key that is plugged into your computer or mobile device to authenticate.
You may use your YubiKey when:
- You are signing into your account on a computer or device that is not assigned to you. When using another computer, you can select the security key sign-in option, insert the YubiKey, and follow the prompts for a PIN and to touch the key.
- You do not use a passkey stored in the Microsoft Authenticator app on your mobile device.
Comparison at a Glance
Comparing Windows Hello, a passkey stored in Microsoft Authenticator, and YubiKeys
| |
Windows Hello |
Passkey in Microsoft Authenticator |
YubiKey |
| What it is |
A Windows Security feature for verifying your identity |
A secure sign in method that uses your mobile device to verify your identity |
A passkey that is stored on a physical security key |
| Where it is |
Your Windows computer |
In the Microsoft Authenticator app on your mobile device |
The physical YubiKey that is inserted into the computer or device you are using |
| How to authenticate with it |
PIN, fingerprint, or facial recognition |
Scan the QR code with your mobile device that has the passkey stored in Microsoft Authenticator. Use the passcode, facial recognition, or fingerprint you use to get into your mobile device. |
You are prompted for a PIN and to touch the YubiKey after it is plugged in |
| When you will use it |
Signing into your computer itself, and into university resources on that computer |
When you are on a non-university owned computer, such as a personal laptop at home, or if you are a Mac user |
When you are signing into a university resource and don't use a passkey in the Microsoft Authenticator app |
| Shared Devices |
You will not use Windows Hello on any computer or device that is not assigned to you |
You will scan the QR code and follow the prompts to sign in |
You will insert and follow the prompts to authenticate with the YubiKey |
Key Takeaways
-
Windows Hello and your passkey in either the Microsoft Authenticator app or on a YubiKey require separate setup. Having Windows Hello set up on your computer does not mean you are done setting up a passkey.
-
Windows Hello is what you will use most often when working on your university-owned Windows computer. You will typically use your Windows Hello PIN to sign in to your computer and authenticate to university resources.
-
A passkey can be stored in Microsoft Authenticator or on a YubiKey.
Microsoft Authenticator stores the passkey on your mobile device.
A YubiKey stores the passkey on a physical security key and can be used instead of Microsoft Authenticator.
Need Help?
If this article needs to be updated, please leave feedback on this article and it will notify the owner of the article.