MacStadium 2FA: how to set up an authenticator app

The MacStadium Portal at portal.macstadium.com is where teams manage their hosted Macs, Orka clusters, users and billing. MacStadium lets anyone with Portal access add two-factor authentication (2FA) with an authenticator app. It's off by default and not required, unless an administrator on your account turns on mandatory 2FA for everyone (MacStadium). The odd part is where the setting lives: not under a profile or account page, but under Users. This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the MacStadium steps come from MacStadium's own documentation, linked below, which we read on October 21, 2026. We haven't tested them on a MacStadium account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Before you start

You need your own login to the Portal. If you don't have one, MacStadium says to ask an existing administrator in your organization to create it, or to email support@macstadium.com with questions (MacStadium).

If your company signs you in to the Portal through SAML single sign-on (Okta, Microsoft Entra ID or Google Workspace), MacStadium points to your identity provider for MFA rules (MacStadium). Its pages don't say whether the Portal's own 2FA applies to SSO users, so check with your IT team first.

Turn on 2FA with an authenticator app

MacStadium's documentation lists these steps (MacStadium):

1. Sign in at portal.macstadium.com.
2. Click your avatar in the top right corner.
3. Choose Users from the menu.
4. Click Security.
5. Click Enable Two-Factor Authentication, then Next.
6. The Portal shows a barcode (a QR code). In Novaz, tap +, then Scan QR code, and point the camera at the screen. If the code is on your iPhone's own screen, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
7. Type the code Novaz shows into the Portal.

When it works, the Security tab shows Active for two-factor authentication.

The documentation doesn't mention a text key you can type instead of scanning. If the Portal offers one, in Novaz tap +, then Enter key manually, and paste it as the Setup key. See What is a 2FA setup key?

Keep a backup before you need it

MacStadium's 2FA page doesn't mention backup or recovery codes. Its only documented way back in without your phone goes through support, and that route asks for "the code used to enable 2FA" (MacStadium). The page doesn't explain what that code is. It most likely means the secret behind the barcode, so if the Portal shows a setup key during step 6, save a copy in a password manager.

This matters with Novaz too: unless you turn on iCloud backup or export a backup file, its keys stay only on your iPhone.

Signing in afterwards

After you enter your username and password, the Portal asks you to open your authenticator app and type the 6-digit code it shows (MacStadium). The documentation doesn't mention a way to trust a device or skip the code on later sign-ins.

Mandatory 2FA for your team

Users with the Administrator role can make 2FA compulsory for every user on the account. MacStadium's page names the button that turns it back off, Disable Mandatory 2FA, but doesn't list the steps to switch it on (MacStadium). If you're asked to set up 2FA on your next sign-in, that's likely why.

If MacStadium rejects your code

MacStadium's documentation doesn't cover rejected codes. The most common cause is a phone clock that's slightly off. On iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?

New phone or lost phone

MacStadium doesn't describe moving 2FA to a new phone. While you can still sign in, the simplest route is to click Disable on the Security tab and then set it up again on the new phone. If you have a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone instead; without one, do this before you reset the old one. See How to transfer your authenticator app to a new iPhone.

If the phone is gone, MacStadium's documented steps are (MacStadium):

1. Email support@macstadium.com and ask for 2FA to be turned off.
2. Give the support team the code you used to enable 2FA.
3. Support turns off 2FA remotely.
4. Sign in again with your username and password, then set 2FA up again.

MacStadium doesn't say what else it may ask for or how long this takes. See also Lost the phone with your authenticator app?

Turning 2FA off

Click Disable on the Security tab (MacStadium). If an administrator has made 2FA mandatory, you may not be able to stay without it. Then open the account in Novaz and tap Remove account.

Official MacStadium help

MacStadium moved its help from support.macstadium.com to docs.macstadium.com. Old links redirect to the new site.

• Two-Factor Authentication (2FA)
• SAML single sign-on for MacStadium accounts
• First-Time SSO Login to MacStadium Portal