MFA: YubiKey OTP Self Registration

A user can self register a YubiKey with their Microsoft Entra ID (formally Azure AD) Account. This is the recommended method for registering a YubiKey as an OATH-TOTP token.

Before you begin

The user account must be in Microsoft Entra ID.
Have a compatible YubiKey.
Install Yubico Authenticator on your mobile device and/or workstation.

Since the YubiKey does not contain a battery it cannot track time and will require software to generate OATH-TOTP codes. Yubico provides Yubico Authenticator for all major platforms (Windows, MacOS, Android, and iOS) to display the one time passcodes generated on the YubiKey.

Register a YubiKey

Open a browser window and navigate to https://myprofile.microsoft.com.
Sign in to your account.
Select Security Info in the left navigation or Update Info in the Security Info tile.

Select Add Method.

Select Authenticator app.

Select I want to use a different authenticator app.

Select Next.
You will now see a QR code displayed on the screen.
Insert your YubiKey and open Yubico Authenticator. Select Add or click on the three vertical dots in the top right corner. If the QR Code is visible, it will automatically fill in the fields required.

Select Add.

Double-click the Microsoft entry to copy the code to your clipboard. If successful, the message displays Code copied to clipboard.

Note: if you selected Require Touch in the previous step you must touch your YubiKey to copy the code.

Back in your internet browser window paste the code in the box and click Next.

Select Done.

You have now successfully registered your YubiKey to your account!