Get and Enroll a Hardware Token or YubiKey

This document provides instructions for obtaining and enrolling Duo hardware tokens and YubiKeys.

EPCS Providers:If you use two-factor authentication for Electronic Prescription of Controlled Substances (EPCS), work with your unit liaison to get provisioned. Do not purchase Duo hardware tokens from the Computer Showcase or follow the instructions here. 
Duo Hardware Token ​YubiKey USB-A

Table of Contents

Before You Begin

  • If you are unsure which two-factor option you want to use, see Two-Factor Authentication Options for more information.
  • A new Duo hardware token has a battery life of five years.

Get at Computer Showcase

Duo hardware tokens are available from the Computer Showcase. Yubikeys are in the final stage of preparation for distribution by the Computer Showcase. Check back here the week of January 20 to see if they are available.

To order a university-funded Duo hardware token, see the Product Description. The university will cover the $25 cost for individuals who cannot use the Duo Mobile app or other phone options. If you have a hardware token that you no longer use, please return it to the Computer Showcase so it can be assigned to someone else.

Enroll Online

  1. Go to Two-Factor (Duo) for Weblogin.
  2. Select the Token Type.
  3. Enter the serial number from the back of your hardware token or YubiKey in the Token Serial Number box.
    Duo Hardware Token Serial Number
    YubiKey Serial Number Serial Number
  4. Click Enroll.

If you prefer, you can ask the ITS Service Center staff to enroll your hardware token for you over the phone (you will be asked to provide information to verify your identity).

Report a Lost or Stolen Token or YubiKey

If you lose your Duo hardware token or suspect it has been stolen, please report it to the ITS Service Center. Service Center staff will mark that token serial number as missing to prevent others from using it.

Resync a Duo Hardware Token

If the login screen displays “Incorrect passcode. Please try again.” your hardware token may be out of sync. You can re-sync it by generating a new passcode three more times and entering each passcode. On the third entry, you should be logged in successfully. 

Delete a Token or YubiKey

To remove a hardware token or YubiKey from your U-M Duo account, go to Turn on Two-Factor (Duo) for Weblogin, log in, and click Enroll a backup or alternate device to get to My Settings & Devices where you can delete the device. See Change You Duo Options and Settings for the detailed steps.

Reassign a Token or YubiKey

To reassign a Duo hardware token or YubiKey from one person to another, either:

  • If the previous owner deleted the device from My Settings & Devices, the new owner can enroll the device online following the instructions above. If the previous owner did not delete the device, the new owner can call the ITS Service Center at 734-764-4357 (4-HELP) to enroll the device.
  • Submit a request to the ITS Service Center with the serial number from the back of the device and the uniqname of the individual to whom it will given. The person who submits the request will be contacted to verify their identity.
Last Updated: 
Wednesday, January 16, 2019