This document provides instructions for obtaining and enrolling U-M hardware tokens and U-M YubiKeys.
EPCS Providers: If you use two-factor authentication for Electronic Prescription of Controlled Substances (EPCS), work with your unit liaison to get provisioned. Do not purchase U-M hardware tokens from the Computer Showcase or follow the instructions here.
- Get at the Computer Showcase
- Enroll Online
- Report Lost or Stolen Token or YubiKey
- Resync a U-M Hardware Token
- Delete a Token or YubiKey From Your Account
- Reassign a U-M Hardware Token or U-M YubiKey
U-M hardware tokens and U-M Yubikeys are available from the Computer Showcase. The university will cover the cost of an initial U-M hardware token or U-M YubiKey for individuals. Individuals can purchase additional or replacement U-M hardware tokens or U-M YubiKeys (need-based exceptions are considered on a case-by-case basis).
If you are unsure which two-factor option you want to use, see Two-Factor Authentication Options for more information. If you have a U-M hardware token that you no longer use, please return it to the Computer Showcase so it can be assigned to someone else. A new U-M hardware token has a battery life of five years.
- Go to Two-Factor (Duo) for Weblogin.
- Select the Token Type.
- Enter the serial number from the back of your U-M hardware token or U-M YubiKey in the Token Serial Number box.
- Click Enroll.
If you prefer, you can ask the ITS Service Center staff to enroll your U-M YubiKey or U-M hardware token for you over the phone (you will be asked to provide information to verify your identity).
If you lose your U-M YubiKey or U-M hardware token or suspect it has been stolen, please report it to the ITS Service Center. Service Center staff will mark that the serial number as missing to prevent others from using it. Individuals can purchase a replacement token or YubiKey (need-based exceptions are considered on a case-by-case basis).
If the login screen displays “Incorrect passcode. Please try again.” your U-M hardware token may be out of sync. You can re-sync it by generating a new passcode three more times and entering each passcode. On the third entry, you should be logged in successfully.
To remove a hardware token or YubiKey from your U-M Duo account, go to Turn on Two-Factor (Duo) for Weblogin, log in, and click Enroll a backup or alternate device to get to My Settings & Devices where you can delete the device. See Change You Duo Options and Settings for the detailed steps.
To reassign a U-M hardware token or U-M YubiKey from one person to another, either:
- If the previous owner deleted the device from My Settings & Devices, the new owner can enroll the device online following the instructions above. If the previous owner did not delete the device, the new owner can call the ITS Service Center at 734-764-4357 (4-HELP) to enroll the device.
- Submit a request to the ITS Service Center with the serial number from the back of the device and the uniqname of the individual to whom it will given. The person who submits the request will be contacted to verify their identity.