1. Home
  2. Security
  3. Duo Multi-Factor Authentication (MFA)
  4. Mobile Passkey Enrollment

Mobile passkey (also called a roaming passkey)

A mobile passkey is a passkey stored in the password manager on your phone, either Google Password Manager or iOS Passwords. The passkey never leaves your phone. When you log in on a computer, you scan a QR code with your phone and approve with your phone's unlock method, such as Face ID or a fingerprint. Because the passkey travels with your phone rather than living on a single computer, it is called a roaming passkey, and you can use it to authenticate on any machine. This is different from a device-bound passkey such as Windows Hello or Touch ID, which only works on the computer where it was created and is covered in a separate guide.

Duo supports mobile passkeys and treats them as security keys during setup. You are welcome to use one if you prefer it over the recommended Verified Push. Because there are many passkey technologies, Emory officially supports only the configurations documented here; other setups may work, but support will vary.

Adding Mobile passkey

The steps below are the same whether you use Chrome or Edge on your computer. The only difference is the screen where you choose where to save the passkey: Google Password Manager on Android, or iOS Passwords on an iPhone. You will need a computer with the Chrome or Edge browser, an existing Duo method (such as Duo Mobile) to verify your identity, and a mobile device with a camera that is signed in to Google Password Manager or iOS Passwords.

On your computer

    1. Sign in to a Duo-protected application (or the Duo Self-Service Portal) with your Emory Network ID and password.

      1

    2. At Welcome to Duo Security, select Get started.

    3. Choose Security key (Duo treats roaming passkeys as security keys).

      1

    4. In the browser's security-key prompt, click Save another way (you are not using a physical key).

      7

    5. Choose Use a phone or tablet as the passkey location. (This is the step that differs by technology - pick your password manager or device here.)

      8

    6. Scan the on-screen QR code with your mobile device's camera, then tap Sign in with a passkey.

      9

    7. Follow the prompts on your mobile device to create and save the passkey.

      10

    8. The passkey now appears as a registered device (for example, Google Password Manager). You can use it to verify your identity at login.

      11

Important: You cannot use a phone call, text message, or Duo Mobile passcode to manage devices. If those are your only options, contact the University Service Desk (404-727-7777) or Emory Healthcare IS Customer Service (404-778-4357).

On your computer

    1. In your browser, open the Duo Self-Service Portal and click Manage Duo.

       1

    2. At the verification prompt, click Other options (do not send a passcode).

       3

    3. Select Manage devices.

      2

    4. Complete the identity verification Duo presents (for example, enter the code in Duo Mobile).

      4

    5. On the device management page, click Add a device.

      5

    6. Choose Security key (Duo treats roaming passkeys as security keys).

      1

    7. In the browser's security-key prompt, click Save another way (you are not using a physical key).

      7

    8. Choose Use a phone or tablet as the passkey location. (This is the step that differs by technology - pick your password manager or device here.)

      8

    9. Scan the on-screen QR code with your mobile device's camera, then tap Sign in with a passkey.

      9

    10. Follow the prompts on your mobile device to create and save the passkey.

      10

    11. The passkey now appears as a registered device (for example, Google Password Manager). You can use it to verify your identity at login.
      11