How to set up and use a YubiKey hardware security key for Microsoft 365 MFA

Summary

This guide helps you troubleshoot and resolve: How to set up and use a YubiKey hardware security key for Microsoft 365 MFA. Follow the steps below to fix the issue.

Common Causes

A YubiKey is a small physical hardware token that plugs into your computer or connects via NFC to your phone. When paired with your Microsoft 365 account, it acts as a second factor at sign-in, replacing less secure methods such as SMS codes or authenticator app prompts. Because the key must be physically present and touched to authenticate, it is highly resistant to phishing and remote attacks, making it an excellent choice for small business owners and home office users who want stronger protection for their email, OneDrive and Microsoft 365 apps.

Before You Begin

• Confirm you have a compatible YubiKey (YubiKey 5 series, Security Key series or YubiKey Bio are all supported by Microsoft).
• Make sure you have a working Microsoft Authenticator app or phone number already registered on your account. Microsoft requires at least one alternative method in case you lose your YubiKey.
• Use a modern browser such as Microsoft Edge, Google Chrome or Mozilla Firefox. Safari is supported on macOS but some older versions may not detect the key reliably.
• If you are setting this up for a business account, your organisation may require you to register the key through the My Sign-Ins portal rather than the standard Security page.

Register Your YubiKey with Microsoft 365

Step 1: Open the Security Settings Page

1. Sign in to myaccount.microsoft.com using your Microsoft 365 work or personal account.
2. Select Security from the left-hand menu.
3. Choose Security options or Advanced security options, depending on your account type.

Step 2: Add a New Sign-In Method

1. Scroll to the Ways to prove who you are section.
2. Click Add a new way to sign in or verify.
3. Select Security key from the dropdown list.
4. Click Add.

Step 3: Set Up the YubiKey

1. A new browser window will open. Choose between USB device or NFC device depending on your YubiKey model.
2. Insert your YubiKey into a USB port on your computer, or tap it against the NFC reader if you selected NFC.
3. Touch the gold contact on the YubiKey when it begins to flash. This confirms your physical presence.
4. Create a memorable name for the key (for example, "Office Desktop YubiKey" or "Personal Laptop Key") so you can identify it later.
5. Click Done to complete registration.

Sign In to Microsoft 365 Using Your YubiKey

1. Go to the sign-in page for any Microsoft 365 service (such as Outlook, OneDrive or portal.office.com).
2. Enter your email address and password as usual.
3. When prompted for additional verification, select Use a security key.
4. Insert or tap your YubiKey and touch the contact when it flashes.
5. You will be signed in automatically.

Managing Your Registered Keys

You can register up to ten hardware keys on a single Microsoft account. To view, rename or remove existing keys:

1. Return to myaccount.microsoft.com > Security > Advanced security options.
2. Locate the key under Ways to prove who you are.
3. Select Remove to delete a lost or decommissioned key, or click the entry to rename it.

Troubleshooting

The YubiKey Is Not Detected

• Try a different USB port, preferably one directly on the computer rather than through a hub.
• If using a USB-C key on an older machine, use an adaptor or switch to a USB-A key.
• Restart your browser with the key inserted before signing in.
• On macOS, open System Settings > Privacy & Security > Security Keys and confirm the key is recognised by the operating system.

Sign-In Loop or "Something Went Wrong" Error

• Clear your browser cookies for login.microsoftonline.com and microsoftonline.com, then try again.
• Disable any browser extensions that interfere with smart card or FIDO2 devices.
• Confirm your computer's date and time are correct, as FIDO2 authentication is time-sensitive.

Lost or Stolen YubiKey

1. Sign in using one of your alternative methods (Microsoft Authenticator, SMS code or recovery code).
2. Go to myaccount.microsoft.com > Security > Advanced security options.
3. Remove the missing key from your account immediately.
4. Register a replacement key as soon as possible.

Key Works on One Computer but Not Another

• Check whether the second computer supports FIDO2. Windows 10 (version 1903 or later), Windows 11, macOS 10.15+ and modern Linux distributions all support FIDO2 natively.
• Update the browser to the latest version.
• On Windows, ensure your operating system is fully updated, as FIDO2 support depends on recent security updates.

Best Practices

• Register at least two YubiKeys per account and store the spare somewhere secure but accessible.
• Label each key discreetly so you can identify it without revealing its purpose.
• Avoid leaving your YubiKey permanently plugged into your computer, as this reduces the security benefit of physical presence.
• Pair your YubiKey with a strong, unique password and review your sign-in activity monthly from myaccount.microsoft.com.

Related Articles

• Password reset (Windows login)

If you have followed these steps and your YubiKey still will not register, or your account has become locked, open a ticket through the 220 support portal and our team will assist you.

Still Having Issues?