KIT 2FA: how to set up an authenticator app for your KIT account
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Your KIT account is the login that students, staff, guests and partners of the Karlsruhe Institute of Technology use for KIT websites, Microsoft 365, the SAP User Portal and the VPN. KIT's Scientific Computing Center (SCC) runs its two-factor authentication (2FA), and Microsoft 365 requires it for all of these groups (KIT).
KIT recommends a passkey first, which replaces your password on KIT websites. But a passkey can't be used for the VPN (KIT), and KIT says the native Microsoft 365 apps on macOS, iOS and Android no longer accept passkeys, so it points you to a time-based code (TOTP) from an authenticator app (KIT). Employees can also get a KIT hardware token with a display (or, in some cases, a YubiKey), and everyone can print a list of backup codes.
This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.
How we checked this guide: the KIT steps come from the SCC's own help pages, linked below, which we read in German and in their English versions on October 20, 2026. We haven't tested them on a KIT account, so a label may differ slightly, and the portal may show German labels. The Novaz steps are checked against the app, version 1.0.5.
Add an authenticator app as a token
KIT calls every second factor a "token," including the one in your app. You manage them in the token management of the SCC Self-Service Portal (KIT):
- On a computer, open my.scc.kit.edu/token and sign in.
- Select New Token.
- In the smartphone token section (Neuer Smartphone Token in German), click Start (German: Starten).
- A QR code appears. In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- Click Confirm token (German: Token bestätigen) and type the code Novaz shows.
KIT only describes scanning and doesn't mention a key you could type. Scan anyway, for a second reason: KIT says its 6-digit codes stay valid for one minute (KIT). The QR code tells Novaz the right timing, while a key typed by hand always gets 30 seconds. To check, open the KIT entry in Novaz and look at Interval under Details.
KIT lists Google Authenticator, Microsoft Authenticator, FreeOTP and Sophos Authenticator as tested. Novaz isn't on that list, but KIT says any app that follows the RFC 6238 standard can make its codes.
Print your backup TAN list right away
Do this before you leave token management. Once your first token is registered, KIT won't let you back in without a token (KIT), so a lost phone with no backup is something you can't fix yourself.
Select New Token, then the Backup TAN list tab (KIT). KIT recommends it if you can keep the printout safe, for example in your wallet or a locked drawer. If you lose the phone without a Novaz backup, this list is how you get back in. More in 2FA backup codes.
Where you'll type the code
- Websites with KIT's single sign-on: any site that signs you in through KIT's central Shibboleth service (sometimes via bwIDM) can ask for your user ID, password and a code (KIT). Microsoft 365 and the SAP User Portal for employees are two that require it (KIT).
- VPN with a second factor: for VPN access that needs 2FA, such as the SAP tunnel, you type your KIT password, a comma, and the code, all in the password field. The configuration file kit-vpn2vlan-2fa.ovpn gives the code a field of its own instead (KIT).
If KIT rejects your code
For VPN logins, check the format first: password, comma, code. Then check your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off.
If a token keeps making codes KIT won't accept, the SCC asks you to phone its Service Desk first and says this can usually be fixed without a new token (KIT). That advice is written mainly for hardware tokens. More causes are in Authenticator code not working?
Changing phones
KIT says to set up the app on the new phone before you reset or retire the old one (KIT). If you back up Novaz with iCloud backup or a backup file, restoring it on the new iPhone brings the KIT token along. Without a backup, sign in to token management with a code from the old phone, add a new smartphone token, and scan it with Novaz on the new iPhone. KIT's pages don't describe removing the old token. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
- Use your backup TAN list or another token you've registered, such as an authenticator app on a work phone (KIT).
- Contact the SCC Service Desk at once (servicedesk@scc.kit.edu) so the lost token can be blocked. If you're stuck without a token, the Service Desk can provide a backup list.
- If the task can wait, KIT suggests leaving it until the next working day or asking a deputy.
KIT's pages don't say what proof the Service Desk asks for or how long it takes. They also don't describe turning 2FA off, and Microsoft 365 needs it anyway. More in Lost the phone with your authenticator app?
