User experience

Early Access release. See Enable self-service features.

When you Order pre-enrolled YubiKeys, users receive the physical security key at their address specified in the shipment.

New users

An email containing the YubiKey PIN is sent to new users' primary and secondary email addresses. After you activate the users in Okta, they receive a welcome email containing the sign-in URL at both the email addresses.

If you need to resend the YubiKey PIN to a user, open the user's profile in the Admin Console. In the Pre-enrolled authenticator tab, click Send PIN.

At the sign-in URL, users enter their username and use their YubiKey to authenticate in Okta. After they successfully sign in for the first time using the YubiKey, the Send PIN button disappears from the user's Pre-enrolled authenticators tab.

Existing users

The user receives an email containing the YubiKey PIN at their primary email address. If you need to resend the YubiKey PIN to a user, open the user's profile in the Admin Console. In the Pre-enrolled authenticator tab, click Send PIN.

At the sign-in URL, users enter their username and use their YubiKey to authenticate in Okta. After they successfully sign in for the first time using the YubiKey, the Send PIN button disappears from the user's Pre-enrolled authenticators tab.

The user can enroll their personal security key or FIDO2 (WebAuthn) authenticator through the Okta End-User Dashboard while the pre-enrolled authenticator fulfillment is pending.