Actionstep 2FA: how to set up an authenticator app

Actionstep is practice management and legal accounting software for law firms, and your sign-in at go.actionstep.com opens your firm's Actionstep system. Actionstep calls two-factor authentication "multi-factor authentication" (MFA), and its only method is an authenticator app on your phone or computer. You can turn it on yourself, or your firm's admin can require it (Actionstep). Setup asks for two codes, not one, and there are no backup codes, so a lockout goes through your firm's admin. This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Actionstep steps come from Actionstep's own help center, linked below, which we read on October 21, 2026. The article pages refused plain automated requests, so we read the same articles through the help center's public article feed on support.actionstep.com. We haven't tested the steps on an Actionstep account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Is it required?

It depends on your firm. An admin can turn on Enforce Multi-factor Authentication (MFA) under Admin > Users & permissions > Authentication settings. Users then can't skip the setup step the first time they sign in, though the admin can exclude named users (Actionstep).

Actionstep adds a regional rule: if your system is in Australia or New Zealand and is linked to Xero or has accounting set up, users without MFA are asked to set it up at every sign-in (Actionstep).

If you sign in with Sign in with Microsoft or Sign in with Google, and MFA is on in both Actionstep and that account, you have to pass both checks (Actionstep).

Turn on MFA with an authenticator app

Actionstep's steps, in Practice Management (Actionstep):

1. Click your user profile icon and choose Manage Profile. The My Profile page opens.
2. In the Password section, look at Multi-factor authentication. If it isn't configured, click Activate.
3. The Set up multi-factor authentication (MFA) window appears with a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on your iPhone's own screen, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
4. If you can't scan, click Show secret key for manual configuration below the QR code. In Novaz, tap +, then Enter key manually, and paste that key as the Setup key. See What is a 2FA setup key?
5. Actionstep wants two codes from your app, typed into two fields. Novaz shows one code at a time, so type the current code in the first field, wait for Novaz to show the next one, and type that in the second.
6. Click Save.

Actionstep's help doesn't say how long its codes are or how often they change. Scanning the QR code is the safer choice, because the code carries those settings into Novaz. A key typed by hand always gets 6 digits every 30 seconds.

Signing in afterwards

You sign in with your email address and password as before, then Actionstep asks for a verification code from your app (Actionstep). The help doesn't mention a way to trust a device and skip the code.

No backup codes

Actionstep's help doesn't mention backup or recovery codes, or any second method. Novaz keeps its keys on your iPhone unless you turn on iCloud backup or export a backup file, so it's worth making a Novaz backup and knowing who your firm's Actionstep admin is before you need them.

If Actionstep rejects your code

Actionstep's help has no advice for rejected codes. During setup, make sure the two codes are two different, consecutive ones. At sign-in, the usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?

If you lose your authenticator

An admin with the right permissions can turn MFA off for you (Actionstep):

1. The admin goes to Admin > Users & permissions and selects your name, or clicks Edit next to it.
2. In the Edit user window, under Multifactor Authentication, they switch MFA Enabled off.
3. They select I accept the billing changes and understand the terms of use, then click Save.

You can then sign in without a code, and Actionstep says you should turn MFA back on yourself with the steps above. If you're the only admin, Actionstep's help doesn't describe another route; its sign-in article points you to Actionstep Support for sign-in problems (Actionstep). See also Lost the phone with your authenticator app?

Changing phones or turning MFA off

Actionstep doesn't describe moving MFA to a new phone. The documented way to switch is to turn it off and set it up again: on My Profile, in the Password section, click Deactivate next to Multi-factor authentication, enter a code from your app, confirm, and click Save (Actionstep). Then activate it again with the new iPhone. Do this while you still have the old one. With a Novaz iCloud backup or backup file, you can skip it and restore the account on the new iPhone instead. See How to transfer your authenticator app to a new iPhone.

If your firm enforces MFA, Actionstep's profile article says that section still lets you review the MFA QR code (Actionstep). It doesn't say what that does to the old phone, so test the new code before removing the old entry.

Official Actionstep help

• Setting Up Individual Multi-Factor Authentication (MFA)
• Enforcing Multi-Factor Authentication or Single Sign-On for Users (Admin)
• Signing in to Actionstep
• Signing in with Microsoft or Google Single Sign-On (SSO)
• Getting to Know the 'My Profile' Page