How to Register a Security Key or Biometric Authenticator for Multi-Factor Authentication (MFA) in Okta

Objective

Following these steps will connect a security key or biometic authenticator as a MFA credential to your account, allowing you to connect to resources that require MFA.

Environment

iOS
Android

Before You Begin

These instructions presume that you have not attempted to log in to a service that requires MFA and were then prompted by that service to register a credential (EBS, for example). If you were prompted to Set up security methods, select Set up under Okta Verify, and then jump to step 7 in the list below and follow the instructions from there.

Steps

1. Navigate to auth.msu.edu (link)
2. Log in with your MSU NetID and password.
3. Select your name from the top-right corner of the screen and choose Settings from the drop-down menu that appears
4. Select the Set up button next to Security Key or Biometric in the Security Methods section of the page
5. Enter your MSU NetID password and select Verify
6. Select Set up
7. A Set up security key or biometric authenticator screen should appear
8. Select Set up
9. Select the option that you prefer to use. USB security key is a physical device you plug into your computer. You can also use your computers built-in sensors, such as Windows Hello or macOS Touch ID, if available on your computer.
   If using a USB security key connect it to your computer before selecting it.
10. If using a USB security key, tap it when it flashes on your computer. If using a built-in sensor, like macOS Touch ID, your web browser will prompt to allow using it to continue.
    Screenshot

    

    The above screenshot is from Google Chrome on macOS Big Sur (version 11.3). Depending on your operating system, and web browser, your prompt will look differently. However, you do have to accept the prompt before proceeding. 

     

11. You're done! Your security key or biometric authenticator should now be connected as a MFA credential for your account and you can now log in to resources that require MFA.
    You may need to select Back to sign in if you were prompted to Set up security methods and skipped to Step 7. Then you can log in again and it will recognize that now you have a MFA credential added.

Additional Info

Okta Verify is the preferred MFA credential for use at MSU. See this article (link) for instructions how to set it up.

USB Security Key Recommendations

Most USB Security Keys that are FIDO2 compatible will work with the above setup. MSU IT recommends the following Yubico USB Security Keys:

• For computers with a USB-C connection: YubiKey 5C NFC
• For computers with the older USB-A connection: Security Key NFC by Yubico

Alternatively, both USB keys are available through the MSU Tech Store:

• YubiKey: https://techstore.msu.edu/accessories?combine=&field_brands_tid%5B%5D=701&commerce_price_amount=All