KnowBe4 2FA: how to set up an authenticator app

KnowBe4 is a work account. Your employer uses it for security awareness training: admins run phishing tests and assign courses in the KnowBe4 console, and staff take the courses in the Learner Experience (LX). KnowBe4 calls its second sign-in step multi-factor authentication (MFA), and it has one method: a six-digit code from an authenticator app, asked for every time you sign in (KnowBe4). Its help describes no text-message option and never mentions backup codes, so plan for a lost phone before you start.

You may not get to choose. Your admins can switch MFA on for you, or require it for every user or for admins only (KnowBe4). If your company signs you in to KnowBe4 through single sign-on (SSO), none of this applies: your SSO provider does the checking. This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the KnowBe4 steps come from KnowBe4's own knowledge base, linked below, which we read on October 20, 2026. We haven't tested them on a KnowBe4 account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Before you start

On a company phone, KnowBe4 suggests checking with your IT team which authenticator app to install. Its list names a few apps and says others work too (KnowBe4). Turning MFA on or off also signs you out of every open KnowBe4 session (KnowBe4).

Turn on MFA in the KnowBe4 console (admins)

KnowBe4's MFA article calls the menu item Profile. Its newer Personal Settings Guide, from September 2026, calls it Personal Settings (KnowBe4), and these steps follow that page:

1. Sign in to your KnowBe4 console.
2. Select your email address in the top-right corner, then Personal Settings. Stay on the Personal Details subtab.
3. Find Multi-Factor Authentication near the bottom and click Enable.
4. A window opens with a QR code and a code you can type instead. In Novaz, tap +, then Scan QR code, and point the camera at the screen. If KnowBe4 is open on the same iPhone, screenshot the QR code and use Choose a photo. See scanning a QR code on the same iPhone.
5. To type the code instead, tap +, then Enter key manually, and put it in Setup key. KnowBe4 doesn't give its length or code interval, and Novaz needs at least 16 characters, so scanning is safer. See What is a 2FA setup key?
6. Type the six-digit code from Novaz into the field, then click OK.
7. Click Update Profile to save the change (KnowBe4).

On the new KnowBe4 platform experience, your email address is at the bottom left; open Personal Settings and use the Password and Security tab (KnowBe4).

Turn on MFA in the Learner Experience

KnowBe4's steps for learners (KnowBe4):

1. Sign in to your KnowBe4 training account.
2. Click your email address in the top-right corner and choose Profile.
3. In the Multi-Factor Authentication section, click Enable.
4. Scan the QR code with Novaz: tap +, then Scan QR code. KnowBe4 only describes a QR code here, not a code to type.
5. Enter the six-digit code that Novaz shows.

A correct code reloads the page with MFA on. The LX got a new look in October 2026, with your name at the bottom of the left menu (KnowBe4), so these older steps may not match your screen exactly.

If an admin set it up for you

An admin can turn MFA on from your profile under Users, on the User Information tab, and pass you the QR code or the typed code. If you get the QR code as an image, save it and add it in Novaz with Choose a photo. If MFA is required for your group, you set it up at your next sign-in (KnowBe4).

When KnowBe4 asks for a code

At every sign-in, unless your admins turn on Remember Trusted Device and set a number of days in Remember Device for. Then a trusted device needs a code once per period (KnowBe4).

If KnowBe4 rejects your code

Go easy on retries: three wrong MFA codes lock you out for an hour, after which the account unlocks by itself (KnowBe4). Wait for a fresh code and check you're reading the KnowBe4 entry.

A wrong iPhone clock is the usual culprit. Go to Settings > General > Date & Time and turn on Set Automatically. Novaz flags a clock that's 15 seconds or more off. More fixes: Authenticator code not working?

Changing phones

KnowBe4 doesn't describe a phone switch. Its help only covers turning MFA off and on again, which admins can do in Personal Settings or on any user's profile. If you back up Novaz, you can restore the KnowBe4 entry on the new iPhone from iCloud backup or a backup file. Without a backup, sort this out while the old phone still works. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

With no backup codes, a person has to let you back in. Learners ask their KnowBe4 admin, who opens your profile, goes to User Information, clicks Disable under Multi-Factor Authentication, then Update User. If MFA is required for all users, you set it up again at your next sign-in; otherwise the admin re-enables it and sends you the new QR code or code (KnowBe4).

Admins locked out by MFA should contact KnowBe4's support team through its request form. KnowBe4 doesn't say what proof it asks for or how long it takes. More help: Lost the phone with your authenticator app?

Turning MFA off

Admins can switch it off under Multi-factor Authentication in Personal Settings and click Update Profile (KnowBe4); for other users they use Disable on the user's profile. KnowBe4 doesn't say whether you can turn it off when your organization requires it. Then open the entry in Novaz and tap Remove account.

Official KnowBe4 help

• Enable Two-Factor or Multi-Factor Authentication on Your Account
• Learner Support: Multi-factor or Two-factor Authentication Applications
• Personal Settings Guide
• KnowBe4 Console Account Settings: User Management
• Session Settings Guide
• Early Adopter: The New KnowBe4 Platform Experience
• Learner Support: Navigating the Learner Experience (LX)