Skip to content
Novaz AuthenticatorGET

ThreatDown Nebula 2FA: how to set up an authenticator app

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Which app to use
  2. Set up 2FA with an authenticator app
  3. No backup codes unless an admin turns them on
  4. If Nebula rejects your code
  5. Changing phones
  6. If you lose your authenticator
  7. Can you turn 2FA off?
  8. Official ThreatDown help

Nebula is the cloud console where IT teams manage ThreatDown endpoint protection on a company's computers. It used to carry the Malwarebytes name, and the old cloud.malwarebytes.com address now forwards to cloud.threatdown.com. Since May 20, 2026, every Nebula user has to use two-factor authentication (2FA) (ThreatDown). ThreatDown describes one method, an authenticator app on a phone, and single sign-on as the only alternative. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the Nebula steps come from ThreatDown's own support articles and release notes, linked below, which we read on October 20, 2026. We haven't tested them on a Nebula account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Which app to use

ThreatDown lists seven supported apps, such as Google Authenticator and Microsoft Authenticator (ThreatDown). Novaz isn't listed, but ThreatDown doesn't say other apps are blocked, and its codes change every 30 seconds, like the ones Novaz makes (ThreatDown).

Set up 2FA with an authenticator app

ThreatDown documents the setup only in outline. You need a phone with a camera, and Nebula walks you through the rest on screen (ThreatDown):

  1. Go to the Nebula sign-in page at cloud.threatdown.com and enter your email address and password.
  2. If you haven't set up 2FA, Nebula asks you to do it before you can get in. Follow the instructions on the screen.
  3. When Nebula shows a code to scan, open Novaz, tap +, then Scan QR code, and point the camera at it. If the sign-in page is on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
  4. If the screen also offers a key to type (ThreatDown doesn't say), tap +, then Enter key manually, and paste it as the Setup key. See What is a 2FA setup key?
  5. Type the current code from Novaz into Nebula to finish.

If your Super Admin has turned on email recovery codes (below), Nebula also asks for a recovery email address on a different domain from your login email (ThreatDown).

Already signed in? ThreatDown's May 2026 release notes point to your profile settings for setup (ThreatDown). The 2FA options are on the Security tab under display name > Profile (ThreatDown).

The ThreatDown Admin phone app asks for a code at sign-in too (ThreatDown).

No backup codes unless an admin turns them on

Nebula has no list of backup codes. Its one recovery option is a code sent by email, off until a Super Admin turns it on for the whole account (ThreatDown):

  1. Go to Configure > Users.
  2. Click the Two-factor authentication button.
  3. Turn on Allow the recovery code to be sent via email.

ThreatDown warns that this is a trade-off: anyone who takes over a user's mailbox could get past 2FA. Putting the recovery address on a different domain is meant to help if the login mailbox is the one compromised. ThreatDown also recommends keeping at least two Super Admins, so each can reset the other's 2FA.

Novaz can keep a copy of its keys through iCloud backup or a backup file, but without one they exist only on the iPhone, so settle both before anyone loses a phone.

If Nebula rejects your code

ThreatDown covers two sign-in errors (ThreatDown):

  • Code is incorrect or expired: the code ran out before you entered it. Sync the time on your phone, then type the newest code before it changes.
  • Session timed out: too long passed after you entered your password. The computer and the phone must agree on the time, so sync the computer's clock (in Active Directory networks, the domain's time settings) and sign in again.

On iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?

Changing phones

While you can still sign in, open display name > Profile, go to the Security tab, and click Reset Settings (ThreatDown). The profile article calls it Reset Two-Factor Authentication Settings, so the label may differ. Then set up 2FA with the new phone. If you have a Novaz iCloud backup or backup file, you can restore the account on the new iPhone instead. Either way, keep the old phone until the new one works. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

You have three routes (ThreatDown):

  • Email recovery code, if a Super Admin turned it on and you set a recovery address. On the Nebula sign-in page, enter your email and password, click Try another way, then Send. Enter the code from the email and click Submit.
  • Another Super Admin resets your 2FA: Configure > Users, Reset next to your name, then Reset 2FA. You set it up again at your next sign-in.
  • ThreatDown Support, if there's no other Super Admin. Every contact option ThreatDown lists starts inside the Nebula console (ThreatDown). ThreatDown doesn't say how to reach Support when locked out, what proof it wants, or how long a reset takes.

More in Lost the phone with your authenticator app?

Can you turn 2FA off?

No, not since May 20, 2026. A company can switch to single sign-on under Configure > Single Sign-On instead, which replaces 2FA: ThreatDown says the two can't run at the same time (ThreatDown).

Official ThreatDown help

More guides: Security, identity and VPN