Introduction

YubiKey as a Service – Enrollment provides different options for organizations to pre-enroll credentials on a YubiKey, allowing their end users to instantly start using their key to authenticate with their identity providers, without first having to register the key.

Credential programming requests for hardware and software are initiated through FIDO Pre-reg API integrations with a customers IT environment. A request is either fulfilled by Yubico, or fulfilled on-site by a customer’s enrollment administrator.

Enrollment Options

The following pre-enrollment options are available:

• FIDO Pre-reg integration: With this option, the keys are factory-programmed by Yubico and shipped globally, from Yubico facilities directly to the end user. The service is available through API integrations with IdPs (identity providers).

  Yubico provides integrations with the following IdPs:

  • Microsoft Entra ID, FIDO Pre-reg with Microsoft Integration Guide.
  • PingOne (PingID/AIC), see FIDO Pre-reg with PingOne Integration Guide (this guide).
  • Okta, see FIDO Pre-reg with Okta Integration Guide.

• Mobile app: This option lets an enrollment administrator access credential requests registered with the organization’s IdP, and program the credentials onto a YubiKey on-site, using a mobile device. The YubiKey is then provided to the end user. For more information, see the YubiID program (Limited Early Access).

• YubiEnroll CLI tool: Using this option, an IT administrator with access to the organization’s IdP, can pre-program credentials onto a YubiKey on-site, on behalf of an end user. The key is then provided to the end user. See YubiEnroll User Guide.