- How to set up a passkey (2FA)

OVERVIEW

Target audience: All McGill faculty, staff, students, retirees, and alumni.

A passkey is a secure way to verify your identity when signing into your McGill account using a trusted device, such as your phone, computer, tablet, or a security key (FIDO2).

Instead of entering a password that can be stolen or waiting for a verification code to be sent to your device, passkeys let you verify your identity using your chosen device's built-in security features, such as your fingerprint, facial recognition, or PIN. When using a passkey, you will no longer have to enter your McGill password when signing in to McGill services that support passkeys.

Note that there are different ways to create and save a passkey. The options below allow you to sign in securely without a password. The main difference is where your passkey is stored:

Passkey: Save your passkey on either a device, in a password manager (such as Apple Passwords or Google Password Manager), or on a security key.
Passkey in Microsoft Authenticator: Save your passkey in the Microsoft Authenticator app on your mobile device.

IMPORTANT: Some services do not support passkeys

If you use either of the following services, do not set up a passkey as your preferred authentication method, as you will not be able to sign in:

GlobalProtect VPN for Linux
Visual Schedule Builder (some features work without signing in)

Instead, use Microsoft Authenticator or another authenticator app for two-factor authentication (2FA).

Some mobile apps, such as, Pxier or Telus Health One also do not support passkeys. However, you can still sign in using your password or another 2FA method, even if you have set up a passkey. McGill has notified the app vendors about these limitations. We recommend enabling automatic app updates on your mobile device to receive passkey support when it becomes available.

In this article:

Create and save a passkey for your McGill account
- Create and save a Passkey
- Create and save a Passkey in Microsoft Authenticator

Create and save a Passkey

Important: Complete the steps below directly on the device you want to use for your passkey (such as your phone, tablet, or computer).

Depending on your device, when creating and saving a Passkey, you will have various options on where to save your passkey.

You can save your passkey on the following:

NOTE

The available options may vary depending on your device and browser. You may have different options for saving your passkey.

- Windows device: Save passkey locally on your Windows (10 or 11) device.
  
  IMPORTANT: This is not available if Windows Hello for Business is already set up on your McGill-managed Windows computer.
- MacOS device: Save your passkey on your Mac using Apple Passwords (iCloud Keychain). You will need iCloud Keychain enabled and you can use Touch ID or your Mac's login password (Face ID, password, or other method).
- iPhone, iPad, or Android device: Save your passkey on your smartphone or tablet.
  - This option requires you to scan a QR code using your device's camera (tap Use passkey when shown).
  - Saving a passkey on your mobile device may also require Bluetooth pairing for verification.
  - Note: By default, you may be prompted to save your passkey in Microsoft Authenticator, but you can also choose to save it in your preferred password manager, such as 1Password.
- Security key: Save your passkey on a security key (FIDO2). For detailed instructions, visit Microsoft: Set up a security key as your verification method
- Password manager: Save your passkey to Microsoft Password Manager or another password manager service, like iCloud Keychain, Google Password Manager, or 1Password. For detailed instructions, visit Microsoft: How to store passwords and passkeys in the Microsoft Password Manager.
  
  IMPORTANT: Microsoft cloud admin and .srv account types are not eligible to use synced passkeys, only device-bound.

Expand the corresponding section below for step-by-step instructions.

Create and save a passkey on Windows device

IMPORTANT: Passkeys cannot be used for McGill-managed Windows devices.

If Windows Hello for Business is already set up on your McGill-managed Windows device, do not select This Windows device when creating your passkeys. Instead, click Change and select another available option.

If you have a personal Windows (10 or 11) device with Windows Hello enabled, you can create a passkey on your Windows device.

To check if you have Windows Hello on your device, you go to Settings > Accounts > Sign-in options. Look for Windows Hello Face, Windows Hello Fingerprint, or Windows Hello PIN. If one of those options are available and set up, you can use Windows Hello to create a passkey.

Once you have confirmed you have Windows Hello, follow the steps below:

Go to https://mysignins.microsoft.com/security-info.
- If prompted, sign in using your McGill username and password, then complete the 2FA steps to verify your identity
Click Add sign-in method.
Select Passkey.
Click Next.
Choose where to save your passkey. Select This Windows device or Continue.

Note: If you are using Windows, your device may be already selected as the default location.

OR
You will be prompted to either enter your PIN, or scan your fingerprint or face.
Type the name of your new passkey, then click Next.
Click Done.

Create and save a passkey on MacOS device

If you are using macOS 15 or later with iCloud Keychain enabled, you can create and save a passkey on your Mac.

Once your passkey is saved you can sign in using:

Touch ID: If your Mac or Magic Keyboard supports Touch ID, you can use your fingerprint to verify your identity.
iPhone or iPad: Scan the QR code displayed on your Mac and follow the prompts on your mobile device to verify your identity using Face ID or another available method.

NOTE

Microsoft cloud admin and .srv account types are not eligible to use this type of passkey, as it is synced instead of bound to the device.

Follow these steps on your Mac device:

Go to https://mysignins.microsoft.com/security-info.
- If prompted, sign in using your McGill username and password, then complete the 2FA steps to verify your identity
Click Add sign-in method
Select Passkey.
Click Next.
Follow the prompts on your computer. If you see “Setting up your passkey”, click Next to continue.
On your Mac, use your TouchID (fingerprint) to save your passkey.
Type the name of your new passkey, then click Next.
Click Done.

Create and save a passkey on iPhone, iPad, or Android device

Follow these steps on your computer:

Go to https://mysignins.microsoft.com/security-info.
- If prompted, sign in using your McGill username and password, then complete the 2FA steps to verify your identity
Click Add sign-in method
Select Passkey
Click Next
Select iPhone, iPad, or Android
Use your mobile device to scan the QR code that appears on your screen.
Follow the instructions on your mobile device.

Note: By default, you may be prompted to save your passkey in Microsoft Authenticator (if installed), but you can also choose to save it in your preferred password manager, such as iCloud Keychain.
Type the name of your new passkey, then click Next.
Click Done.

Create and save a Passkey in Microsoft Authenticator

IMPORTANT: Set up Microsoft Authenticator app before you start.

You must have the Microsoft Authenticator app set up on your mobile device before following these steps. If you have not set it up, visit the Microsoft Authentication setup instructions.

Go to https://mysignins.microsoft.com/security-info.
- If prompted, sign in using your McGill username and password, then complete the 2FA steps to verify your identity
Click Add a sign-in method
Select Passkey in Microsoft Authenticator.
Click Next.
Follow the on-screen instructions.
Note: You will be prompted to open the Microsoft Authenticator app on your mobile device and follow the instructions in the app.
Once you have created your passkey in the Microsoft Authenticator app, click Next on your computer.
You will see a notification saying Passkey created. Click Done.