If you see this message on the CUWebLogin screen, you can enroll.

Step 1: Confirm That Beyond Identity Is Installed

The Beyond Identity Authenticator software is required to use passkeys. This software can be automatically deployed to Cornell-managed devices and software updates are also managed by Cornell. You should not need to install the Beyond Identity software manually.

It will appear in your Launchpad (macOS) or system tray (Windows).

If it is not installed, contact your IT Service Group for assistance. 

Step 2: Configure Biometrics on Your Device

Follow the instructions to set up biometrics on your device.

If you've already configured Windows Hello or Touch ID on your device, please move on to the next step.

Alternative: It is possible to use Secure Connect without Windows Hello or Touch ID by entering your password (instead of biometrics) every time you need to log in. This method is not preferred, but it will work.

Step 3: Enroll a Passkey - or - Add a New Device

I'm Already Using Secure Connect

If you have already set up Secure Connect on another device follow the instructions to Add Another Device to Secure Connect.

I'm Setting Up Secure Connect for the First Time

Open the Beyond Identity Self-Service Portal in your browser. (Link opens in a new window.)

1. Log in with your Cornell NetID and password (authenticate with Two-Step Login if prompted).
2. Click the Register New Passkey button.
3. Your browser may ask if you wish to allow Beyond Identity to be opened. Select always allow and open the application. This is required for the passkey to work correctly. (Your prompt may look slightly different.)
   

   If passkey enrollment is successful, Beyond Identity will open and show your newly created passkey.

   
4. Close the Beyond Identity window.
5. You have now set up Secure Connect on your device. To finish, you'll need to set up your browser to use Secure Connect. Note that CUWebLogin will remember you for 24 hours, so you'll want to do this part in a day or two.

Set Up Your Browser to Use Secure Connect

The next time you need to log in to CUWebLogin, you will set up your browser to use Secure Connect. (CUWebLogin will remember you for 24 hours, so you'll want to do this part a day or two after you last used CUWebLogin.)

1. Go to a service that requires CUWebLogin (Workday, for example).
   
   On the CUWebLogin screen, make sure Remember my Username is checked and then click Login.
   
2. On the next screen, choose Log in with Passkey.
    
   CUWebLogin remembers you for about a day. You may not see "Log in with Passkey" until CUWebLogin resets its timer.
   
   
   If you also check the Always Log in with Passkey Automatically box, you will no longer be prompted for a username and password, nor will you need to authenticate with Duo in this browser.
3. (Optional) If you use different web browsers (for example Chrome and Firefox) on the same device, repeat the browser setup steps on each browser. As long as you are using the same device, you do not need to enroll another passkey.

CUWebLogin will remember that you've logged in for about a day. The next time you use CUWebLogin on this browser, you will be prompted to use your biometrics to unlock your passkey (instead of entering your NetID and password).

Troubleshooting

If you are setting up your browser for Secure Connect and do not see either screen, check the following:

• Did you select Remember My Username on the CUWebLogin screen (see Set Up Your Browser)? If not, check that box the next time you see it.
• Beyond Identity will not work without a device-side level of security. If you don't have biometrics (or a device password) set, then do so and start again with Enroll a Passkey.

If you are prompted for your NetID and password after setting up your browser:

• Are you using a different browser that doesn't have Secure Connect set up? Secure Connect is specific to your web browser and needs to be set up on each browser you use.
• If you set up all of your browsers to use Secure Connect, then you can open one of your browsers in "incognito" or "private" mode to open the CUWebLogin screen to access the system with your NetID and password.

If you are unable to use Secure Connect, contact the IT Service Desk for assistance.

Share Your Thoughts

The Secure Connect project team would like to know more about your experience with passkey login. Participate in this short survey to give feedback.