YubiKey Setup: Add a Security Key to Microsoft and Google Accounts

To add a YubiKey or any FIDO2 security key, open your Google Account's 2-Step Verification settings and enroll the key, and for a personal Microsoft account open Advanced security options, choose Add a new way to sign in or verify, and follow the security key prompts. Then do the same with a second key so you have a backup. A hardware key proves you physically hold the device, which makes it harder for a remote attacker to take over your account with a stolen password.

Who this is for and what you will have at the end

This guide is for individuals and small business owners who want to protect their own Microsoft and Google accounts with a hardware key. By the end you will have a key registered on both accounts, a second key registered as backup, an understanding of the difference between a security key and a passkey stored on a key, and a plan for a lost key.

The steps come from Google's and Microsoft's support pages, checked on 2026-10-30. Menus change often, so match the steps to what you see. This guide covers personal Microsoft accounts and Google Accounts. Work or school accounts are managed by an administrator, so options may differ; see passkeys in Entra ID deployment guide for the organizational side.

What you need

• Two security keys. Google says any FIDO1 or FIDO2 key can serve as a second step, and a FIDO2 key is required to create a passkey on a key. Buy from the manufacturer or a retailer you trust. YubiKey is one brand; keys from other makers also qualify if they support FIDO2.
• The right connector. Security keys come as USB and NFC models. Microsoft's setup prompts ask whether your key is USB or NFC, so check what ports your computer and phone have.
• A current browser and operating system. Google recommends a compatible browser such as Chrome and notes that newly registered keys do not work on Android 8.0 and lower. Keep your browser and operating system updated.
• Another way to sign in. Keep your phone number, recovery email or another verification method up to date for recovery.

Security key versus passkey on a key

Google explains the difference. A security key used as a second step is an additional check after your password. A passkey saved on a key lets you skip your password, and because it proves you have the device it replaces the second step. You can change this in your account settings if you prefer always to use your password.

Use the table to decide what you want.

Passkeys saved on a key need a FIDO2 key. For the wider topic, see passkeys explained and how to set them up.

Part 1: Add a security key to a Google Account

1. Open a compatible browser such as Chrome, and sign in to your Google Account.
2. Go to your 2-Step Verification security key settings. You may need to sign in again.
3. Follow the prompts to enroll the key. Insert the key or tap it when asked, and touch it if it has a touch sensor.
4. After enrollment, return to the security key list. Next to the key, select the pencil icon to rename it. The default name is "Security Key." Use a name that tells you which key it is, such as the location where it is stored.

Google says to expect a waiting period of up to 7 days before a newly added key can be used at sign-in, which protects the account if someone tries to add a key without permission. Plan around that: register your keys before you remove other second steps.

Add the backup key

Repeat the steps with your second key. Google recommends adding other ways to verify your identity and considering a spare key stored safely.

Remove a key

Next to the key in the list, select the trash bin icon and confirm. You may need to sign in again. Remove a key if you lose it or stop using it.

If Google flags a key as suspicious, Google says to confirm it within 30 days or it will be deleted.

Part 2: Add a security key to a personal Microsoft account

Microsoft's personal account flow in its passkey guidance uses a single entry point.

1. On the device you will use, open your Microsoft account's advanced security options at account.live.com/proofs/manage and sign in.
2. Select Add a new way to sign in or verify.
3. Select Face, Fingerprint, PIN, or Security Key.
4. Follow the on-screen instructions on your device.
5. When you are asked where to save the passkey, select Change or Save another way to see all save locations, then choose Security key.
6. Complete the process. You may be asked for an unlock gesture such as a fingerprint, face or a PIN. Insert or tap the key when prompted.

Microsoft's article says to perform these steps on the device on which you want to create the passkey, and describes the option as saving the passkey to a physical security key. Repeat the process with your second key so both are registered.

Microsoft's guidance for older flows has described the route as Security, then More security options, then Add a new way to sign in or verify, then Use a security key, where you choose USB or NFC and create a PIN. Wording varies by account type and date, so follow what your screen shows.

Work or school accounts

Microsoft's separate article for work or school accounts says the feature must be enabled by your administrator and you must already have at least one other verification method registered. The route there is My Account, then Security Info, then Add method, then Security key, where you choose USB or NFC, follow the prompts, set a PIN and name the key. Microsoft says you can register up to 10 keys, and that security keys are for verification only, not for password reset. If the option is missing, ask your administrator.

Verify that it works

1. Sign out of the account, or open a private browser window.
2. Sign in with your usual method and choose the security key option when prompted.
3. Insert or tap the key and enter its PIN if asked.
4. Repeat with the backup key to confirm that both work, once any waiting period has passed.
5. Store the backup key in a different safe place from the primary one.

On Windows, Microsoft's work or school guidance notes that Chrome and Edge may prioritize a passkey stored on a phone, and that on Windows 11 version 23H2 or later you can choose Security key under More choices.

Lost key, reset and PIN

Lost key

Sign in with another registered method, remove the lost key and add a replacement. Google describes exactly this process. Do it as soon as you can, because a lost key plus a known PIN could be used by someone else if they also have your password.

Reset a key

Microsoft's article says that deleting a key from Security info stops it from signing you in but leaves data on the key. To return the key to factory defaults, Microsoft points to Windows Settings, then Accounts, then Sign-in options, then Security Key, then Manage. Resetting removes the credentials stored on it, so remove the key from your accounts first or expect to register it again.

Change the PIN

The same Windows page lets you change the key's PIN. Pick a PIN you can remember, because Microsoft describes the key as requiring both the physical device and the PIN.

Troubleshooting

The security key option does not appear in Microsoft's menu. Make sure you started from the advanced security options page on the device where you want to create the key, and try the other entry route. A Microsoft community thread reports the option missing on one personal account while working on another, with no official fix, so contact Microsoft support if it persists.

The key is not recognized. Try another USB port or the NFC reader position, update the browser and operating system and try another browser. Google notes that newly registered keys do not work on Android 8.0 and lower.

Sign-in with the new Google key fails right after adding it. Google says there may be a waiting period of up to 7 days. Use your existing second step in the meantime.

You cannot add a passkey to the key. Google says creating a passkey on a key requires a FIDO2 key. An older FIDO1 key can still serve as a second step.

Your organization blocks it. On work or school accounts, the administrator controls the option.

Checklist

1. Buy two FIDO2 security keys from a trusted source.
2. Register the first key on your Google Account and your personal Microsoft account.
3. Register the second key on both accounts, allowing for any waiting period.
4. Rename keys so you know which is which.
5. Keep recovery options current.
6. Store the backup key in a safe place away from the first.
7. Test sign-in with each key.
8. If a key is lost, sign in another way, remove it and add a replacement.

References

• Google Account Help, Use a security key for 2-Step Verification: https://support.google.com/accounts/answer/6103523
• Microsoft Support, Create and save a passkey: https://support.microsoft.com/en-us/accounts-billing/security/create-save-passkey
• Microsoft Support, Set up a security key as your verification method: https://support.microsoft.com/en-us/security/sign-in-to-your-account-with-a-security-key