Enroll an OTP Configured Yubikey for Okta Multi-Factor Authentication

Environment

University of Michigan, Multifactor Authentication, Okta

Issue

Instructions for obtaining and enrolling a YubiKey (Passcode) for Multifactor Authentication (MFA).

Resolution

Important Considerations

Note: This article is for existing users of YubiKeys in OTP or Passcode mode. If your YubiKey is not configured for OTP mode, please see Enroll a YubiKey (Security Key) for Okta Multi-Factor Authentication.

  • For most users who wish to use a security key, an Okta hardware token is a better option as it offers more flexibility and is automatically enrolled for you at the time of purchase.
  • A YubiKey used as an OTP or Passcode device can only be registered to one account and an account can only have one YubiKey registered.
    • This means that one YubiKey cannot be used for both a uniqname and a non-person account (such as an m-uniqname account); you must choose one account with which to register your YubiKey.
  • A YubiKey should only be used as an additional MFA device (the Okta Verify app is the recommended MFA method used in tandem with a YubiKey).

Obtain a YubiKey

  • YubiKeys are available for purchase at the ITS Tech Shop (opens in new window) either online or in person. 
  • You can have multiple YubiKeys enrolled for Okta at the same time.

Add a YubiKey (OTP) to Your Account

  1. Go to your Okta account settings. 
  2. Click Manage security methods.
  3. Click Set up or Set up Another next to “YubiKey Authenticator”.
  4. You will be prompted to enter your password and verify using your preferred method, if prompted.
  5. Click Yubikey Authenticator-Set Up.
  6. Click Set up.
  7. The exact steps for enrollment and authentication using Yubikeys will vary depending on the operating system, browser, and security key model. Follow the guided enrollment steps to complete setup for your device.

Additional Information

  • If you use a password manager you may experience some variance from these instructions. 
  • The experience of setting up a Yubikey varies across operating systems and browsers.  ITS (SC and IAM) provides this general knowledge article but if you need additional assistance we recommend using another option (e.g., Okta Verify or an Okta hardware token).
  • As of February 2026, some users in Chrome are prompted for a PIN on their Yubikey that has not yet been established. Using Firefox as your browser may allow you to succeed.

Need additional information or assistance with Okta? Michigan Medicine affiliates, contact HITS. Other U-M affiliates, contact the ITS Service Center.

Print Article