NCEdCloud WebAuthn — Hardware Key and Biometric MFA Setup

What is WebAuthn in NCEdCloud?

NCEdCloud WebAuthn is the web authentication standard that allows users to log in using a hardware security key or biometric device — such as a YubiKey, Windows Hello, or a fingerprint reader — instead of a TOTP code. NCEdCloud supports WebAuthn as an MFA method within NCDPI’s RapidIdentity platform.

WebAuthn is phishing-resistant because the credential is bound to the specific website domain and cannot be replicated by a fake login page. This applies to staff and administrator accounts at LEAs that have enabled MFA in NCEdCloud. The most important thing to know is that WebAuthn requires a compatible device and browser — Chrome or Edge on Windows, macOS, or Android are the most reliable combinations.

WebAuthn vs. TOTP in NCEdCloud

Supported WebAuthn Authenticators for NCEdCloud

• YubiKey 5 series (USB-A or USB-C)
• Windows Hello (fingerprint, facial recognition, or PIN on Windows 10/11)
• Apple Touch ID or Face ID (on supported Mac or iOS devices in Safari/Chrome)
• Android biometric authenticators (fingerprint in Chrome)
• Any FIDO2-compliant security key

How to Enroll a WebAuthn Device in NCEdCloud

1. Log in to NCEdCloud at ncedcloud.mcnc.org with your username and password.
2. Go to Account Settings and select “MFA” or “Security Keys.”
3. Choose “Add Security Key” or “Register WebAuthn Device.”
4. When prompted, insert your security key into a USB port or position your device for a biometric scan.
5. Touch the key’s gold disc or confirm the biometric prompt on your device.
6. The browser asks you to confirm the registration. Click Allow or Confirm.
7. Name the device (for example, “YubiKey office” or “Windows Hello laptop”) for future reference.
8. Click Save. The device is now registered.

How WebAuthn Login Works After Enrollment?

1. Go to ncedcloud.mcnc.org and enter your username and password.
2. After credentials are verified, NCEdCloud prompts for your security key or biometric.
3. Insert the key and touch it when the light flashes, or provide the biometric as prompted.
4. NCEdCloud verifies the WebAuthn assertion and loads the dashboard.

No code entry required. The entire second factor step takes under five seconds.

What to Do if You Lose Your WebAuthn Device?

If your security key is lost or your biometric device is unavailable:

1. Contact your LEA help desk immediately.
2. Ask them to temporarily disable MFA on your account or switch you back to TOTP.
3. Log in using the alternate method.
4. Re-enroll a new WebAuthn device or configure TOTP as a backup.

If your district uses YubiKeys, report the loss to your technology coordinator as well — the key may need to be deprovisioned from other systems.

Frequently Asked Questions

Does NCEdCloud require WebAuthn, or is TOTP also accepted?

NCEdCloud accepts both WebAuthn and TOTP for MFA. You can enroll in one or both. WebAuthn offers stronger phishing resistance, but TOTP is simpler to set up and recover. Choose based on your district’s guidance and your device availability.

Can I use Windows Hello for NCEdCloud WebAuthn?

Yes. Windows Hello is a FIDO2-compliant authenticator that works with NCEdCloud’s WebAuthn MFA. Use Chrome or Edge on Windows 10 or 11 and enroll Windows Hello from Account Settings. After enrollment, your fingerprint or facial recognition serves as your second factor.

Can students use WebAuthn in NCEdCloud?

WebAuthn support for students depends on whether your LEA has enabled MFA requirements for student accounts. Most districts that deploy WebAuthn do so for staff and administrators first. If your district issues hardware keys to students or has modern Chromebooks with biometric readers, student WebAuthn enrollment is possible.

My security key is not being recognized during NCEdCloud enrollment. What should I do?

First, try a different USB port. Second, confirm you are using Chrome or Edge — some WebAuthn features work inconsistently in Firefox or Safari, depending on the platform. Third, verify the key is FIDO2 compliant, not just FIDO U2F. If none of these resolve the issue, contact your LEA IT department to confirm that WebAuthn is enabled in your district’s NCEdCloud configuration.

Can I have both a WebAuthn key and TOTP enrolled at the same time?

Yes. NCEdCloud allows multiple MFA methods to be enrolled. Having both a WebAuthn key and TOTP configured gives you a backup if one method is unavailable. This is a recommended practice for staff and administrators who rely on daily SSO access.

Related Reading

NCEdCloud MFA Setup Guide (/ncedcloud-mfa/)

NCEdCloud TOTP FAQ (/ncedcloud-totp-faq/)

NCEdCloud Account Locked — How to Unlock (/ncedcloud-account-locked/)

NCEdCloud Login Troubleshooting (/ncedcloud-not-working/)

NCEdCloud LEA Administrator Role Overview (/ncedcloud-lea-administrator/)