Skip to content
Novaz AuthenticatorGET

BGL 2FA: how to set up an authenticator app for Simple Fund 360 and CAS 360

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Turn on MFA with an authenticator app
  2. No backup codes
  3. When BGL asks for a code
  4. If BGL rejects your code
  5. Changing phones
  6. If you lose your authenticator
  7. Official BGL help

BGL Corporate Solutions makes Simple Fund 360, the SMSF administration software, and CAS 360 for company secretarial work. Both use the same BGL 360 sign-in. On these accounts, multi-factor authentication (MFA) isn't optional: BGL makes it mandatory for every user so its software meets the Australian Taxation Office's operational framework for digital service providers (BGL). You choose between an authenticator app and SMS codes, and BGL recommends the app. Email codes aren't offered at all (BGL). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the BGL steps come from BGL's own Simple Fund 360 help center, linked below, which we read on October 21, 2026. The article pages blocked automated access and the web.archive.org copy wasn't reachable, so we read the same articles through the help center's public article feed on support.sf360.com.au. We haven't tested them on a BGL account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on MFA with an authenticator app

BGL's help describes this flow in Simple Fund 360 (BGL). Its YubiKey article uses the same Set Up button for CAS 360 (BGL).

  1. Sign in to Simple Fund 360 and select the person icon in the top right corner to open the Profile Management screen.
  2. Under the Authentication App option, select Set Up. A QR code appears.
  3. In Novaz, tap +, then Scan QR code, and point the camera at the screen. If the QR code is on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
  4. If you can't scan, BGL also shows a code on screen that you can type in. Its help doesn't give that code a name. In Novaz, tap +, then Enter key manually, and put it in Setup key. See What is a 2FA setup key?
  5. Type the 6-digit code from Novaz into Simple Fund 360, without spaces, and select Next.
  6. Enter your mobile phone number, then select Finish.

The phone number step surprises some people. If you haven't also set up SMS, BGL says the number is only kept to identify you during account recovery, and it won't text you codes. Give a number you'll keep: you'll need it if you ever lose the authenticator (see below).

No backup codes

BGL's help doesn't mention backup or recovery codes. Your fallbacks are SMS, which you can add as a second method on the same profile screen, and the self-service reset below. Unless you turn on iCloud backup or keep a backup file in Novaz, its keys exist only on your iPhone, so plan for that now.

When BGL asks for a code

At each sign-in, after your username and password, an Enter Security Code page asks for the 6-digit code from your app or from SMS. A remember this device for 30 days checkbox skips the code on that computer and browser, then select Submit (BGL).

BGL says the 30-day pass resets with a different browser or computer, private browsing, cleared or blocked cookies, or a new IP address (BGL). To remove a computer from your trusted list, BGL says to call it on 1300 654 401.

If your firm signs in through a SAML identity provider such as Microsoft Entra ID or Okta, BGL doesn't prompt for MFA. Your identity provider handles it instead (BGL).

If BGL rejects your code

The error BGL documents is "Invalid Token or Token mismatch". Its advice is to check the clock on the phone running the app: if it's more than 30 seconds off, the code won't work (BGL). On iPhone, go to Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?

Changing phones

BGL has no way to copy the authenticator to a new device. You turn MFA off, and the next sign-in prompts you to set it up again (BGL). While you can still sign in, open the Profile Management screen and select Disable next to the active method. On the Novaz side, an iCloud backup or a backup file lets you restore your accounts on the new iPhone instead; without one, follow BGL's steps. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

BGL has a self-service reset (BGL):

  1. On the BGL 360 login page, enter your username and password and select Sign In.
  2. On the Enter Security Code page, select Lost my device.
  3. Enter your email address, your mobile phone number and the captcha, then select DISABLE MY MFA.
  4. Open the email BGL sends and select its link. Check your spam folder if it doesn't arrive. The login page then confirms MFA is off, and you set it up again at your next sign-in.

That's why the mobile number from setup matters. If the phone was lost or stolen, BGL also strongly recommends changing your BGL 360 password.

Alternatively, the Account Owner of your BGL subscription can turn off MFA for you in the User Manager (Settings, User List tab, expand your name, TURN OFF MFA), and you get an email saying so (BGL). One FAQ answer in BGL's main MFA article still says administrators can't do this, so the Account Owner role is what counts. BGL doesn't say how long either route takes. See also Lost the phone with your authenticator app?

Official BGL help

More guides: Payments, accounting and insurance