Elastic Cloud 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Elastic Cloud is where you run hosted Elasticsearch deployments and Serverless projects. The same sign-in at cloud.elastic.co also opens Elastic's Support Hub and Learning Portal. If you sign in with an email address and password, multifactor authentication (MFA) is mandatory and can't be switched off (Elastic).
The methods are an authenticator app, a security key or biometrics, and an email code. Text messages are no longer offered. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the Elastic Cloud steps come from Elastic's own documentation, linked below, which we read on October 20, 2026. We haven't tested them on an Elastic Cloud account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Who sets up MFA in Elastic Cloud
- Email and password sign-in: you need at least one method. Since September 2024, Elastic sends anyone without one to a setup screen at sign-in and holds them there until it's done (Elastic).
- Google or Microsoft sign-in only: you can't set up MFA in Elastic Cloud. Your Google or Microsoft account handles it.
- SAML single sign-on: your company's identity provider handles MFA.
If you later add a password to a Google or Microsoft account, Elastic asks you to turn on MFA the next time you sign in with it (Elastic).
Set up an authenticator app
Elastic's documentation gives these steps (Elastic):
- Sign in to the Elastic Cloud Console at cloud.elastic.co.
- Open your User settings and choose Profile, then scroll to the Multifactor authentication section.
- On the Authenticator app card, select Set up.
- In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- If scanning doesn't work, Elastic lets you enter a code by hand; its documentation doesn't name the link or the key. In Novaz, tap +, then Enter key manually, and type it as the Setup key. See What is a 2FA setup key?
- Type the code from Novaz and select Enable authentication method.
Elastic doesn't publish the length or lifetime of its codes. A key typed by hand in Novaz always makes 6-digit codes that change every 30 seconds, so scan the QR code when you can: it tells the app the right settings.
No backup codes, so add a second method
Elastic's documentation doesn't mention backup or recovery codes. Instead, it recommends setting up at least two methods, so losing one doesn't lock you out.
This matters with Novaz if you haven't backed it up: without iCloud backup or a backup file, its keys stay only on your iPhone. Set up the Email card as well, or a security key on the Security key or biometrics card. Elastic sends MFA email codes to one address only, and you can't add another (Elastic).
When Elastic Cloud asks for a code
Elastic's FAQ says you answer an MFA challenge on every sign-in. It mentions a planned Trust this device option that would skip it for a month. That FAQ dates from the September 2024 rollout, so this may have changed.
MFA applies to anything that signs in through Elastic Cloud, including Log in with Elastic Cloud on a Kibana login screen. It doesn't apply when you choose Log in with Elasticsearch in Kibana or connect straight to an Elasticsearch endpoint.
If Elastic Cloud rejects your code
Elastic's pages give no advice for this. Check the iPhone's clock first: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?
Moving to a new iPhone
If you have a Novaz iCloud backup or backup file, restore your accounts on the new iPhone and the authenticator keeps working. Without one, switch while you still have the old phone. Elastic doesn't describe a phone change, but its documented steps cover it: make sure a second method is set up, select Remove on the authenticator app, then set it up again on the new iPhone. Elastic won't remove your last method (Elastic). See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
If you set up email or a security key, sign in with that, then remove the old authenticator and add a new one.
If none of your methods work, Elastic says to contact support. Its troubleshooting page lists the Elastic Support Portal and support@elastic.co, and asks you to write from your registered email address (Elastic). The Support Portal uses the same Elastic Cloud login, so email may be your only way to reach support while you're locked out. That page is written for customers with an Elastic subscription, and Elastic doesn't say what proof it asks for or how long it takes. See Lost the phone with your authenticator app?
Can you turn it off?
No, not for password sign-in. You can only swap the authenticator app for another method.
