Get and Enroll a Hardware Token or YubiKey

This document provides instructions for obtaining and enrolling Duo hardware tokens and YubiKeys.

EPCS Providers:If you use two-factor authentication for Electronic Prescription of Controlled Substances (EPCS), work with your unit liaison to get provisioned. Do not purchase Duo hardware tokens from the Computer Showcase or follow the instructions here.
Duo Hardware TokenYubiKey USB-A

Table of Contents

Get at the Computer Showcase

Duo hardware tokens and Yubikeys are available from the Computer Showcase. The university will cover the cost of an initial hardware token or YubiKey for individuals who cannot use the Duo Mobile app or other phone options. Individuals can purchase additional or replacement hardware tokens or YubiKeys (need-based exceptions are considered on a case-by-case basis).

If you are unsure which two-factor option you want to use, see Two-Factor Authentication Options for more information. If you have a hardware token that you no longer use, please return it to the Computer Showcase so it can be assigned to someone else. A new Duo hardware token has a battery life of five years.

Enroll Online

  1. Go to Two-Factor (Duo) for Weblogin.
  2. Select the Token Type.
  3. Enter the serial number from the back of your hardware token or YubiKey in the Token Serial Number box.
    Duo Hardware Token Serial Number
    YubiKey Serial Number Serial Number
  4. Click Enroll.

If you prefer, you can ask the ITS Service Center staff to enroll your YubiKey or hardware token for you over the phone (you will be asked to provide information to verify your identity).

Report a Lost or Stolen Token or YubiKey

If you lose your YubiKey or Duo hardware token or suspect it has been stolen, please report it to the ITS Service Center. Service Center staff will mark that the serial number as missing to prevent others from using it. Individuals can purchase a replacement token or YubiKey (need-based exceptions are considered on a case-by-case basis).

Resync a Duo Hardware Token

If the login screen displays “Incorrect passcode. Please try again.” your hardware token may be out of sync. You can re-sync it by generating a new passcode three more times and entering each passcode. On the third entry, you should be logged in successfully.

Delete a Token or YubiKey

To remove a hardware token or YubiKey from your U-M Duo account, go to Turn on Two-Factor (Duo) for Weblogin, log in, and click Enroll a backup or alternate device to get to My Settings & Devices where you can delete the device. See Change You Duo Options and Settings for the detailed steps.

Reassign a Token or YubiKey

To reassign a Duo hardware token or YubiKey from one person to another, either:

  • If the previous owner deleted the device from My Settings & Devices, the new owner can enroll the device online following the instructions above. If the previous owner did not delete the device, the new owner can call the ITS Service Center at 734-764-4357 (4-HELP) to enroll the device.
  • Submit a request to the ITS Service Center with the serial number from the back of the device and the uniqname of the individual to whom it will given. The person who submits the request will be contacted to verify their identity.
Last Updated: 
Wednesday, May 15, 2019