Esri 2FA: how to set up an authenticator app for your ArcGIS account
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Your Esri sign-in is an ArcGIS account, used for ArcGIS Online, ArcGIS Pro, the ArcGIS apps and My Esri (Esri). Esri calls two-factor authentication multifactor authentication (MFA), and not every account can have it. It's only for members of an ArcGIS organization who sign in with an ArcGIS login, after an administrator has allowed it (Esri). The second step is a six-digit code from an authenticator app, with optional security keys and recovery codes. This guide uses Authenticator App - Novaz on iPhone; any app that makes time-based codes works the same way.
How we checked this guide: the Esri steps come from Esri's own ArcGIS Online documentation and an Esri Support article, linked below, which we read on October 20, 2026. We haven't tested them on an ArcGIS account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Can your account use it?
- Organization member with an ArcGIS login: yes, if your administrator has turned it on. If the organization enforces MFA, ArcGIS walks you through setup at your next sign-in (Esri).
- Public account: no. An Esri account counts as an ArcGIS public account (Esri), and Esri's troubleshooting page says public accounts can't use MFA (Esri).
- GitHub, Facebook, Google or Apple login: no, even inside an organization.
- Your employer's single sign-on (SAML or OpenID Connect): the second step belongs to your identity provider, not to ArcGIS.
No option in your settings? Your administrator turns it on under Organization > Settings > Security (Esri) with Enable multifactor authentication for organization, and names at least two administrators to handle members' requests for help (Esri).
Turn on 2FA with an authenticator app
These steps follow Esri's ArcGIS Online help (Esri):
- Sign in, click your name at the top of the site, and choose My settings.
- On the Security tab, find Multifactor Authentication and click Enable.
- With Novaz on your iPhone, click Next.
- In Novaz, tap +, then Scan QR code, and scan the QR code ArcGIS shows. If ArcGIS is open on the same iPhone, take a screenshot and use Choose a photo (scanning a QR code on the same iPhone). Click Next.
- If scanning fails, click Can't scan the code to see a 16-character code. In Novaz, tap +, then Enter key manually, and type it as the Setup key. See What is a 2FA setup key?
- Type the six-digit code from Novaz and click Next.
- If your organization allows recovery codes, click Print or Download, tick I have saved the recovery codes, and click Done.
- ArcGIS then offers to register a security key. Do it now, or click Skip for now.
Esri asks you not to keep a copy of the 16-character code. Its help doesn't say how often codes change, so scanning is safer: the QR code carries those settings.
Recovery codes depend on your organization
Recovery codes exist only if an administrator has turned on Allow use of recovery codes (Esri). Each works once, and ArcGIS shows the list a single time without storing it (Esri). Unless you back up Novaz with iCloud backup or Export to file…, its keys exist only on your iPhone, so these codes are your way in if the phone is gone. Print them or keep them in a password manager. Running low, or worried someone saw them? Click Generate new recovery codes on the Security tab; the old list stops working. See 2FA backup codes.
Without recovery codes, a registered security key (a USB key, or Face ID or Touch ID) is the only fallback that doesn't need an administrator.
When ArcGIS asks for a code
Every sign-in to your organization: after your username and password, type the six-digit code and click Verify (Esri). A session lasts two weeks at most, even with Keep me signed in.
One catch: MFA only works in apps that sign in through OAuth 2.0. Apps without it, some ArcGIS Server services such as routing and elevation analysis, and stored credentials for Esri premium content need MFA turned off (Esri). If one of these breaks, talk to your administrator.
If ArcGIS rejects your code
Start with your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?
Esri's troubleshooting page adds two points. If an administrator turned MFA off for the whole organization, it's off on your account too. And if you still can't sign in, ask an administrator to turn MFA off on your account (Esri).
Changing phones
Do this while the old phone still makes codes. How depends on your organization:
- MFA not enforced: click Disable on the Security tab, then Enable, and scan the new QR code with the new phone (Esri).
- MFA enforced: click Reset in the Multifactor Authentication section, sign in again, and go through setup with the new phone. Members on the exemption list don't get this button (Esri).
If you have a Novaz iCloud backup or backup file, you can restore it on the new iPhone instead, and your ArcGIS codes keep working. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Esri's troubleshooting page gives this order (Esri):
- A second security key or device you registered.
- A recovery code: after your password, choose Lost access? Use recovery code (Esri).
- Your administrators. On the Multifactor Authentication page, click Having trouble signing in with your code? and answer your security question. ArcGIS emails your organization's designated administrators. Once one turns MFA off on your account, sign in with your password and set it up again.
This goes to your organization's administrators, not Esri Support, and Esri doesn't say how long it takes. More in Lost the phone with your authenticator app?
Turning 2FA off
Click Disable on the Security tab of your settings. That button isn't there if your organization enforces MFA, unless you're on the exemption list. An administrator can also turn it off for you (Esri).
