Get and Enroll a U-M Hardware Token or U-M YubiKey

This document provides instructions for obtaining and enrolling U-M hardware tokens and U-M YubiKeys.

EPCS Providers: If you use two-factor authentication for Electronic Prescription of Controlled Substances (EPCS), work with your unit liaison to get provisioned. Do not purchase U-M hardware tokens from the Tech Shop or follow the instructions here.
Duo Hardware TokenYubiKey USB-A


Get at the Tech Shop

U-M hardware tokens and U-M Yubikeys are available from the Tech Shop. The university will cover the cost of an initial U-M hardware token or U-M YubiKey for individuals. Individuals can purchase additional or replacement U-M hardware tokens or U-M YubiKeys (need-based exceptions are considered on a case-by-case basis).

If you are unsure which two-factor option you want to use, see Two-Factor Authentication Options for more information. If you have a U-M hardware token that you no longer use, please return it to the Tech Shop so it can be assigned to someone else. A new U-M hardware token has a battery life of five years.

Enroll Online

  1. From a desktop or laptop computer, go to UMICH Account Management.
  2. Log in with your uniqname and UMICH (Level-1) password.
  3. Click Add a Duo Hardware Token or Yubikey.
  4. Select the Token Type.
  5. Enter the serial number from the back of your U-M hardware token or U-M YubiKey in the Token Serial Number box.

    Hardware Token Serial Number YubiKey Serial Number
  6. Click Enroll.

    If you prefer, you can ask the ITS Service Center staff to enroll your U-M YubiKey or U-M hardware token for you over the phone (you will be asked to provide information to verify your identity).

    Report a Lost or Stolen Token or YubiKey

    If you lose your U-M YubiKey or U-M hardware token or suspect it has been stolen, please report it to the ITS Service Center. Service Center staff will mark that the serial number as missing to prevent others from using it. Individuals can purchase a replacement token or YubiKey (need-based exceptions are considered on a case-by-case basis).

    Resync a U-M Hardware Token

    If the login screen displays “Incorrect passcode. Please try again.” your U-M hardware token may be out of sync. You can re-sync it by generating a new passcode three more times and entering each passcode. On the third entry, you should be logged in successfully.

    Delete a Token or YubiKey

    To remove a hardware token or YubiKey from your U-M Duo account, go to UMICH Account Management, log in, and click Manage Duo Devices to get to My Settings & Devices where you can delete the device. See Change You Duo Options and Settings for the detailed steps.

    Reassign a U-M Hardware Token or U-M YubiKey

    To reassign a U-M hardware token or U-M YubiKey from one person to another, either:

    • If the previous owner deleted the device from My Settings & Devices, the new owner can enroll the device online following the instructions above. If the previous owner did not delete the device, the new owner can call the ITS Service Center at 734-764-4357 (4-HELP) to enroll the device.
    • Submit a request to the ITS Service Center with the serial number from the back of the device and the uniqname of the individual to whom it will given. The person who submits the request will be contacted to verify their identity.
Last Updated: 
Tuesday, August 18, 2020