Asana 2FA: how to set up an authenticator app

Asana is where many teams plan and track their work. Its two-factor authentication (2FA) has a single method: a code from an authenticator app, asked for after your email and password (Asana). Asana's help says nothing about backup codes, so read the recovery section before you start. For most people 2FA is optional, but an admin on an Enterprise plan can make it mandatory. This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Asana steps come from Asana's own help center, linked below, including the screenshots in its articles, which we read on October 20, 2026. We haven't tested them on an Asana account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

Asana's 2FA article, last updated in July 2026, gives these steps (Asana):

1. In Asana, click your profile photo in the top-right corner and open My Settings. Asana's older screenshots call it My Profile Settings....
2. On the Account tab, click Two-Factor Authentication (it shows Off for now).
3. Enter your password to verify your account and click Continue.
4. Asana shows a QR code, with a code you can type instead printed just above it. In Novaz, tap +, then Scan QR code. On the same iPhone, take a screenshot and use Choose a photo (scanning a QR code on the same iPhone). Then click Continue.
5. Under Enter code, type the 6-digit code from Novaz and click Enable.

Scan the QR code if you can. In Asana's screenshots the typed key is 16 characters on the settings screen but only 12 on the setup screen shown at sign-in, where it's called a secret key. Novaz needs at least 16 characters for a typed key, so a shorter one has to be scanned. Asana also doesn't say how often its codes change, and a QR code passes that setting to the app. More in What is a 2FA setup key?

When your organization requires it

On Enterprise, Enterprise+ and the older Legacy Enterprise plan, admins can require 2FA for every member and guest (Asana). Then:

• Asana emails you and shows a banner asking you to set it up.
• At your next login, Asana takes you through setup: a Scan this barcode screen with the QR code and secret key, then Continue, then the 6-digit code from Novaz.
• New users invited to the organization set it up during sign-up, after Accept Invite.
• If you haven't set it up after 7 days, Asana logs you out until you do. After 14 days it invalidates your password, and you'll need Forgot Password before you can log in again.

If the organization requires SSO or SAML, full members don't need Asana's 2FA. Guests who log in with a password still do.

When Asana asks for a code

With 2FA on, you need a code each time you log in with your email and password, on the web, the desktop app and the mobile app (Asana). The code goes on a screen called Enter authentication code, followed by Continue. In the mobile app, that screen comes after Continue with email, your password and Log in (Asana).

Asana's help doesn't describe a way to trust a device and skip the code. Members can also log in with Google by default (Asana), and the help doesn't say whether Asana asks for the app code on that route.

If Asana rejects your code

Asana's mandatory 2FA article warns that each code stays valid for "a few seconds only" (Asana). Type it promptly, and use the new code if Novaz moves on. If codes keep failing, check the iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. For anything else, Asana's advice is to contact Support. See also Authenticator code not working?

Changing phones

Asana's FAQ says you can change your 2FA device from your profile settings, without giving the steps (Asana). The steps it does document are turning 2FA off and setting it up again under Two-Factor Authentication, so do that with the new phone in hand. Or, if you have a Novaz iCloud backup or backup file, restore your accounts on the new iPhone and the codes keep working. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Neither of Asana's 2FA articles mentions backup codes, recovery codes or a second method. Unless you can restore Novaz from iCloud backup or a backup file, these are the ways back in that Asana documents:

• You're still logged in somewhere. Turning 2FA off only asks for your password, not a code (see below). Then set it up again on your new phone.
• Your organization is on Enterprise, Enterprise+ or Legacy Enterprise. An admin can turn off 2FA for you in the admin console: on the members tab, Edit profile settings, then the Security tab and Two-Factor Authentication. Asana only allows this if you belong to no other domain (Asana).
• Otherwise, Asana Support. Open the chatbot at the bottom right of the Help Center homepage, describe the problem, answer Yes when it offers support, and give your name and email. Topics include Logging in (Asana). Asana doesn't say what proof it asks for or how long this takes.

More in Lost the phone with your authenticator app?

Turning 2FA off

Open My Settings, go to the Account tab and click Two-Factor Authentication. Enter your Asana password and click Disable (Asana). Then remove the Asana entry from Novaz: open it and tap Remove account.

Official Asana help

• Two-factor authentication
• Mandatory two-factor authentication
• Authentication and access management options for paid plans
• How do I get support from Asana?