General questions

What is a passkey?

A passkey is a secure way to verify your identity when signing into your McGill account using a trusted device, such as your phone, computer, tablet, or a security key. 

Instead of entering a password that can be stolen or waiting for a verification code to be sent to your device, passkeys let you verify your identity using your chosen device's built-in security features, such as your fingerprint, facial recognition, or PIN. 

Passkeys are linked to specific websites or apps, which helps protect you from phishing attacks. For example, if someone tricks you into visiting a fake McGill sign-in page, your passkey won't work because it only works with the legitimate sign-in service. This prevents attackers from stealing your passkey through fake sign-in pages.

---

What are the different types of passkeys?

There are two types of passkeys:

• Synced passkeys: Stored securely and synchronized across compatible devices. This makes it easier to sign in when you switch devices or get a new phone or computer.
• Device-bound passkeys: Stored on a specific device, such as computer, phone, or a security key. They cannot be synced to other devices.

Both types offer secure, phishing-resistant sign-in using your device's built-in security features or a security key (FIDO2).

---

What is a security key (FIDO2)?

A FIDO2 security key is a small physical device that you plug into or tap against your computer or mobile device to securely sign in to websites and apps. It verifies your identity without requiring a password. It uses FIDO2, a secure authentication technology that helps protect your accounts from unauthorized access and phishing attacks.

---

Which security keys (FIDO2) can I store my McGill account passkey on? 

Microsoft maintains a list of eligible keys that can be used and updated monthly. Newly released security keys take up to four weeks to be recognized by Microsoft after they are added to the FIDO Alliance database. 

---

Why can't I use text message (SMS) or phone calls as an authentication method?

Microsoft is discontinuing these verification methods as of January 28, 2027. McGill offers more secure authentication options, including Microsoft Authenticator and passkeys.

---

Do I have to use a passkey?

No. Passkeys are optional and offer the McGill community another secure way to verify their identity when signing in. 

Microsoft Authenticator app remains McGill's recommended and IT Services-supported authentication method. Other supported authenticator apps can also be used for 2FA. For authenticator app setup instructions, see Two-Factor Authentication (2FA): Setup Instructions.

---

Who can use passkeys at McGill?

Passkeys are available to McGill students, staff, affiliates, retirees, and alumni. 

Note: Microsoft cloud administrator and .srv accounts cannot use synced passkeys.

---

What if I do not have a smartphone?

You can use a passkey on a supported computer, tablet, or security key. You can also use OneAuth, a free desktop application, for 2FA.

---

Using passkeys

Will I need to use my passkey every time I sign in?

How often you are asked to verify your identity using a passkey depends on the application and its security requirements.

However, when using a passkey you can quickly verify your identity using your device's built-in security feature such as, fingerprint, face recognition, or PIN, scan a QR code with your phone, or use a physical security key, making it faster and more seamless.

---

Why do I still need a password if I have a passkey?

You still need a password, because currently not all McGill applications and services support passwordless sign-in. You may still need your password for certain systems.

---

What happens if I get a new phone or computer?

If you use a synced passkey, you can transfer it to your new device through your passkey provider. Otherwise, you will need to register a new passkey on your new device. We recommend registering a backup authentication method in case you lose access to your passkey.

---

What if I lose access to my passkey or device?

1. You will need to use your backup authentication method to sign-in. When prompted to verify your identity with your passkey, you can click Cancel and select your backup verification method. If you cannot sign in using any registered method, contact the IT Service Desk for assistance.
2. You will need to remove your old passkey and create and save a new one.
   1. Go to https://mysignins.microsoft.com/security-info 
      • If prompted, sign in using your McGill username and password, then complete the 2FA steps to verify your identity
   2. Create and save new passkey, click Add sign-in method and follow the on-screen instructions
   3. Delete your old passkey

For instructions, visit how to set up a passkey.

---

Can I use a passkey without an internet connection?

No. Passkeys cannot can work without an internet connection. You need internet access on both the device where your passkey is stored, and the device you are using to sign in to McGill's online services.

For example, if your passkey is saved on your mobile device and you are trying to log in to your McGill email on your laptop, both need to be connected to Wi-Fi or mobile data.

If you expect to be in situations where you will need to connect to McGill's online services without having Wi-Fi or mobile data, make sure you have another supported authentication method available, such as Microsoft Authenticator app, that can generate a one-time codes, or a security key.

Note: A passkey stored on a security key is the only exception. These never require an internet connection to work.

Security and privacy

Are passkeys secure?

Yes. Passkeys are designed to protect against common phishing attacks because they cannot be used to sign in on fake websites. However, you should still be cautious about suspicious emails, links, and unexpected sign-in requests.

---

Can someone steal my passkey if they know my password?

Knowing your password alone does not give someone access to your passkey. Passkeys are protected by your device or passkey provider and cannot simply be copied from a phishing website.

---

Who can access my fingerprint or facial recognition data?

Your biometric information stays on your device and is not shared with McGill or Microsoft during passkey authentication. Your device uses this information locally to verify your identity.