Cisco Meraki 2FA: how to set up an authenticator app for the dashboard

The Meraki dashboard is the web console admins use to run Cisco Meraki networks and devices. Its two-factor authentication (2FA) now works only with an authenticator app: Meraki retired text-message codes in stages and switched them off for good by November 30, 2025 (Cisco Meraki, in Japanese).

Meraki's screens name Duo Mobile, Cisco's own app, but the same FAQ says any app that makes time-based codes (TOTP) will do. It's optional unless your organization requires it. This guide uses Authenticator App - Novaz on iPhone, and other authenticator apps work the same way. It covers the dashboard only: Meraki Go has its own setting in the Meraki Go app (Cisco Meraki).

How we checked this guide: the Cisco Meraki steps come from Meraki's own documentation, linked below, including the screenshots in it, which we read on October 20, 2026. We haven't tested them on a Meraki account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Before you start

• The option may be hidden for now. Meraki is moving a small group of accounts to a new sign-in system, and those accounts can't set up 2FA under My profile until the move is done. If you need 2FA urgently, Meraki says to contact support (Cisco Meraki).
• SAML admins are exempt. The organization's security settings, the 2FA requirement included, don't apply to SAML administrator accounts (Cisco Meraki).
• Have a second admin. Meraki advises at least two organization admins with Full permissions (Cisco Meraki). It makes recovery much easier.

Turn on 2FA with an authenticator app

Meraki's help describes these steps (Cisco Meraki):

1. Sign in to the dashboard, open the account menu at the top right, and choose My profile.
2. Scroll to Two-factor authentication and select Set up two-factor authentication.
3. Follow the steps under Set up app. Meraki's help doesn't show whether you get a QR code, a text key or both. For a QR code, tap + in Novaz, then Scan QR code, or screenshot it and use Choose a photo if the dashboard is on the same iPhone (how). For a key, tap +, then Enter key manually, and paste it into Setup key (about setup keys).
4. Under Verify your device, type the current Novaz code into Code and select Verify. Meraki's codes have 6 digits and change every 30 seconds.
5. Select Continue, then OK.

The dashboard signs you out, then asks for a code when you sign in again. Meraki documents no option to remember a trusted computer.

Your eight one-time codes

Meraki gives you eight backup codes, each good for one sign-in. You can view them anytime, as One-time codes in the Two-factor authentication section of My profile. Generate a new set of one-time codes replaces all eight and cancels any unused old ones (Cisco Meraki).

Meraki suggests Duo Mobile with Duo Restore (Cisco Meraki), or another app with cloud backup (Cisco Meraki). Novaz can do this too, with iCloud backup or an exported backup file; without one, its keys stay on that iPhone. These codes are still your safety net if that backup is missing or out of date, so keep them in a password manager or on paper away from the phone. See 2FA backup codes.

When the organization requires it

An organization admin can turn on Force users to set up and use two-factor authentication under Organization > Configure > Settings (Cisco Meraki). While it's on, nobody can turn off their own 2FA. Switching it off removes no one's 2FA, and switching it back on applies it to everyone again (Cisco Meraki).

If Meraki rejects your code

Meraki's help says nothing about rejected codes. Check the iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?

Changing phones

Meraki's way to switch apps or phones is to turn 2FA off and set it up again (Cisco Meraki), so do it before you wipe the old iPhone. If you have a Novaz iCloud backup or backup file, you can restore it on the new iPhone instead, and Meraki keeps working. See How to transfer your authenticator app to a new iPhone. If your organization requires 2FA, you can't turn it off yourself, and Meraki doesn't describe another route, so talk to an organization admin first.

If you lose your authenticator

Start with a one-time code: sign in with it, then turn 2FA off and set it up again on the new phone.

Without the codes, only Meraki Support can remove 2FA, after confirming you own the account. It won't do this over the phone. On Cisco's Meraki support page, go to No dashboard access? and select Create a case (form). Use the locked account's email address and give the organization's full name. Meraki then checks ownership one of two ways (Cisco Meraki):

• Another organization admin with Full access exists. You confirm by replying to the automatic case email, and that admin approves by commenting on the case in the dashboard. "Email or phone approval is not acceptable." Network and read-only admins can't approve.
• No other admin can help. Support asks for details about the organization, then sends the organization admin a DocuSign form to sign before updating the case.

If 2FA is required in any organization the account belongs to, that requirement must be switched off everywhere before support can act. Meraki doesn't say how long recovery takes. More in Lost the phone with your authenticator app?

Turning 2FA off

In My profile, under Two-factor authentication, select Turn off two-factor authentication and confirm your password (Cisco Meraki).

Official Cisco Meraki help

• How to Configure and Manage Two-Factor Authentication
• SMS による多要素認証の廃止についてのよくあるご質問 (FAQ on the end of text-message codes, in Japanese)
• Temporary changes to account management and security settings affecting select users
• Organization Settings
• Enabling Multi-Factor Authentication in Meraki Go
• Open a Cisco Meraki support case