Security Keys for Duo

Michigan Tech uses Duo, a two-factor authentication service to verify your identity when you log into systems with access to sensitive information.

When you log into a system like Banner or Experience, Duo will ask you to choose a method to verify your identity. Duo requires a secondary verification device such as a phone, tablet, PIN generator, or USB security key.

​​​​​What are Security Keys?

A security key plugs into your USB port, and when tapped or when the button is pressed, it sends a signed response back to Duo to validate your login. Duo uses the U2F and WebAuthn authentication standards to interact with your security keys. You may also see WebAuthn referred to as “FIDO2”.

Security Key Requirements

To use a security key with Duo, make sure you have the following:

• A supported browser (Chrome 70 or later, Firefox 60 or later, Safari 13 or later, or Microsoft Edge 79 or later)
• An available USB port
• A supported USB security key (WebAuthn/FIDO2 security keys from Yubico are supported by Michigan Tech.)

Duo does not support U2F-only security keys (like the Yubikey NEO-n).

Registering a Security Key in Duo

You can enroll your security key during the initial self-enrollment process or, if you have already enrolled in Duo using a different device (like your mobile phone), you can add your security key as an additional authentication device from the Device Management portal.

During Initial Self-Enrollment

1. Navigate to a website that requires Duo, such as Gmail, or visit our Two-Step Registration page. Make sure that you're not blocking pop-up windows for the enrollment site before continuing.
2. When prompted, sign in.
3. Select Security Key from the list of devices under “What type of device are you adding?" and select Continue.
4. Follow the on-screen instructions to finish registering your security key. You may need to allow Duo to access information about your security key during setup.

Adding a Security Key as Another Device in Duo

1. Navigate to a website that requires Duo, such as Gmail, or visit our Two-Step Registration page. Make sure that you're not blocking pop-up windows for the enrollment site before continuing.
2. When prompted by Duo to sign in, select Cancel or Other options. If you selected Cancel continue to step 3, otherwise skip to step 4.
3. From the Login canceled page, select Other options.
   
4. From the Other options menu choose Manage devices.
   
5. Select your preferred method to verify your identity.
6. Select Add a device.
   
7. Select Security Key from the available options and select Continue. 
8. Follow the on-screen instructions to finish registering your security key.

Authenticating with a Security Key

The next time you log on using Duo, you can tap or insert your security key to log in. Some types of keys flash as a prompt for you to authenticate. In different browsers, you may need to select your security key from the drop-down list of your authentication devices.

Once you select your security key from the list, follow the on-screen instructions to finish the authentication process.

Limitations with Security Keys

• Not all websites and applications support the use of security keys.
• Unable to be used on devices accessed remotely (through Remote Desktop on Windows, Windows App on Mac, or other remote desktop applications).
• Can get lost, stolen, or broken.