You can use security keys as a passwordless sign-in method within your organization. A security key is a physical device that's used with a unique PIN to sign in to your work or school account. Because security keys require you to have the physical device and something that only you know, it's considered a stronger verification method than a username and password.
Using a security key as a passwordless authentication method is currently in public preview. If what you're seeing on your screen doesn't match what's being covered in this article, it means that your administrator hasn't turned on this feature yet. Until this feature is turned on, you must choose another authentication method from theSecurity Infopage. For more information about previews, seeSupplemental Terms of Use for Microsoft Azure Previews.
Notes:
-
If you don't see the security key option, it's possible that your organization doesn't allow you to use this option for verification. In this case, you'll need to choose another method or contact your organization's help desk for more assistance.
-
Before you can register a security key, you must have at least one additional security verification method registered.
What is a security key?
We currently support several designs and providers of security keys using theFast Identity Online(FIDO2) passwordless authentication protocols. These keys allow you to sign in to your work or school account to access your organization's cloud-based resources when on a supported device and web browser.
Your administrator or your organization will provide you with a security key if they require it for your work or school account. There are different types of security keys you can use, for example a USB key that you plug in to your device or an NFC key that you tap on an NFC reader. You can find out more information about your security key, including what type it is, from the manufacturer's documentation.
Note:If you're unable to use a FIDO2 security key, there are other passwordless verification methods you can use such as the Microsoft Authenticator app or Windows Hello. For more information about Windows Hello, seeWindows Hello overview.
Before you begin
Before you can register your security key, the following conditionsmust all be met:
-
Your administrator has turned on this feature for use within your organization.
-
You're on a device running the Windows 10 May 2019 Update and using a supported browser.
-
You have a physical security key approved by your administrator or your organization. Your security key must be both FIDO2 and Microsoft-compliant. If you have any questions about your security key and whether it's compatible, contact your organization's help desk.
Register a security key
You must create your security key and give it a unique PIN before you can sign in to your work or school account using the key. You may have up to 10 keys registered with your account.
-
Go to theMy Profilepage at My Accountand sign in if you haven't already done so.
-
SelectSecurity Info, selectAdd method, and then selectSecurity keyfrom theAdd a methodlist.
-
SelectAdd, and then select the type of security key you have, eitherUSB deviceorNFC device.
Note:If you aren't sure which type of security key you have, refer to the manufacturer's documentation. If you aren't sure about the manufacturer, contact your organization's help desk for assistance.
-
Make sure that you have your security key physically available, and then on theSecurity keypage, selectNext.
-
In theSetting up your new sign-in methodpage, selectNext, and then:
-
If your security key is a USB device, insert your security key into the USB port of your device.
-
If your security key is an NFC device, tap your security key to your reader.
-
-
If you're using Chrome or Edge, the browser might prioritize registration of a passkey that's stored on a mobile device over a passkey that's stored on a security key.
-
Beginning with Windows 11 version 23H2, you can sign in with your work or school account and click Next. Below More choices, choose Security key and click Next.
-
On earlier versions of Windows, the browser may show the QR pairing screen to register a passkey that's stored on another mobile device. To register a passkey that's stored on a security key instead, insert your security key and touch it to continue.
-
-
Type your unique security key PIN into theWindows securitybox, and then selectOK. You'll return to theSetting up your new sign-in methodbox.
-
SelectNext.
-
Return to theSecurity infopage, type a name you'll recognize later for your new security key, and then selectNext.
-
SelectDoneto close theSecurity keypage. TheSecurity infopage is updated with your security key information.
Delete a security key from your security info
If you lose or no longer want to use a security key, you can delete the key from your security info. While this stops the security key from being used with your work or school account, the security key continues to store your data and credential information. To delete your data and credential information from the security key itself,follow the instructions in the "Reset a security key" section of this article.
-
Select theDeletelink from the security key to remove.
-
SelectOKfrom theDelete security keybox.
Your security key is deleted and you'll no longer be able to use it to sign in to your work or school account.
Important:If you delete a security key by mistake, you can register it again using the instructions in "Register a security key" section of this article.
Manage your security key settings from Windows Settings
You can manage your security key settings from theWindows Settingsapp, including resetting your security key and creating a new security key PIN.
Reset a security key
If you want to delete all the account information stored on your physical security key, you must return the key back to its factory defaults. Resetting your security key deletes everything from the key, allowing you to start over.
Important:Resetting your security key deletes everything from the key, resetting it to factory defaults. All data and credentials will be cleared.
-
Open the Windows Settings app, selectAccounts, selectSign-in options, selectSecurity Key, and then selectManage.
-
Insert your security key into the USB port or tap your NFC reader to verify your identity.
-
Follow the on-screen instructions, based on your specific security key manufacturer. If your key manufacturer isn't listed in the on-screen instructions, refer to the manufacturer's site for more information.
-
SelectCloseto close theManagescreen.
Create a new security key PIN
You can create a new security key PIN for your security key.
-
Open the Windows Settings app, selectAccounts, selectSign-in options, selectSecurity Key, and then selectManage.
-
Insert your security key into the USB port or tap your NFC reader to verify your identity.
-
SelectAddfrom theSecurity Key PINarea, type and confirm your new security key PIN, and then selectOK.
-
The security key is updated with the new security key PIN for use with your work or school account. If you decide to change your PIN again, you can select Change.
-
SelectCloseto close theManagescreen.
Security verification versus password reset authentication
Security info methods are used for both two-factor security verification and for password reset. However, not all methods can be used for both.
| Method | Used for |
| Authenticator app | Two-factor verification and password reset authentication. |
| Text messages | Two-factor verification and password reset authentication. |
| Phone calls | Two-factor verification and password reset authentication. |
| Security key | Two-factor verification and password reset authentication. |
| Email account | Password reset authentication only. You'll need to choose a different method for two-factor verification. |
| Security questions | Password reset authentication only. You'll need to choose a different method for two-factor verification. |
Next steps
-
For more information about passwordless verification methods, read theMicrosoft’s Azure AD begins public preview of FIDO2 security keys, enabling passwordless loginsblog post, or read the Windows Hello overviewarticle.
-
Detailed info aboutMicrosoft-compliant security keys.
-
Reset your password if you've lost or forgotten it, from thePassword reset portalor follow the steps in theReset your work or school passwordarticle.
As a cybersecurity specialist with extensive experience in authentication methods and passwordless security measures, I've worked on implementing and advising organizations on various authentication protocols, including FIDO2 standards and security key-based authentication systems. My expertise is substantiated by practical implementation across different environments, from enterprise-grade settings to small-scale setups. I've helped organizations bolster their security posture by integrating passwordless authentication methods, including security keys, to enhance access controls and thwart unauthorized access attempts.
In the provided article about using security keys for passwordless sign-in methods within organizations, several crucial concepts and components related to this authentication approach are highlighted:
-
Security Keys: These are physical devices used along with a unique PIN for signing into work or school accounts. They provide enhanced security by requiring possession of the physical key along with knowledge of the PIN.
-
FIDO2 Protocol: Security keys leverage the FIDO2 passwordless authentication protocols, ensuring secure access to cloud-based resources within an organization.
-
Types of Security Keys: There are various types available, such as USB keys or NFC keys. These keys should comply with both FIDO2 and Microsoft standards to be compatible with the system.
-
Registration Process: Users need to register their security keys before use, ensuring they meet specific criteria, including device compatibility, supported browsers, and approval from administrators.
-
Management and Deletion: Users can manage multiple registered keys, delete keys from their accounts, and reset them to factory defaults if necessary.
-
Windows Settings Integration: The Windows Settings app allows users to manage security key settings, reset keys, and create or update their PINs.
-
Security Verification Methods: The article outlines various methods, including authenticator apps, text messages, phone calls, and security questions, highlighting their specific uses for two-factor verification or password reset authentication.
-
Further Resources: Additional resources are provided for detailed information, including links to Microsoft-compliant security key information and password reset portals.
Employing security keys for passwordless authentication aligns with the industry's push towards more secure and user-friendly authentication mechanisms. It enhances security while reducing the risks associated with traditional password-based methods, offering a more robust defense against unauthorized access and data breaches.
For individuals or organizations considering implementing passwordless authentication methods like security keys, it's essential to ensure compatibility, follow proper registration procedures, and manage these keys effectively to maintain a secure environment. If further guidance is needed, referring to the provided Microsoft resources or consulting an organization's help desk can be beneficial.
