A user can self-register a YubiKey with their Azure AD Account. This is the recommended method for registering a YubiKey as an OATH-TOTP token.
Before you begin
- The user account must be in Azure AD.
- Have a compatible YubiKey.
- Install Yubico Authenticator on your mobile device and/or workstation.
Since the YubiKey does not contain a battery it cannot track time and will require software to generate OATH-TOTP codes. Yubico provides Yubico Authenticator for all major platforms (Windows, MacOS, Android, and iOS) to display the one time passcodes generated on the YubiKey.
Register a YubiKey
- Open a browser window and navigate to https://myprofile.microsoft.com.
- Sign in to your account.
- Select Security Info in the left navigation or Update Info in the Security Info tile.
- Select Add Method.
- Select Authenticator app.
- Select I want to use a different authenticator app.
- Select Next.
- You will now see a QR code displayed on the screen.
- Insert your YubiKey and open Yubico Authenticator. Select Add or +. If the QR Code is visible, it will automatically fill in the fields required.
- Select Add.
- Double-click the Microsoft entry to copy the code to your clipboard. If successful, the message displays Code copied to clipboard.
Note: if you selected Require Touch in the previous step you must touch your YubiKey to copy the code.
- Back in your internet browser window paste the code in the box and click Next.
- Select Done.
You have now successfully registered your YubiKey to your account!