ThreatDown OneView 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
If you know it as Malwarebytes OneView, it's the same console: the old address, oneview.malwarebytes.com, now opens a sign-in page titled ThreatDown OneView. Managed service providers use it to run endpoint security, subscriptions and invoicing for their customers' sites (ThreatDown, ThreatDown).
Two-factor authentication (2FA) is no longer optional there. Since May 20, 2026, every OneView user must have it, and anyone without it is held at sign-in until they set it up (ThreatDown). The second step is a code from an authenticator app, unless your organization signs in through single sign-on (SSO). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the OneView steps come from ThreatDown's own help center for OneView, linked below, which we read on October 20, 2026. We haven't tested them on a OneView account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
ThreatDown's 2FA page lists seven supported apps, such as Google Authenticator and Microsoft Authenticator, and Novaz isn't one of them (ThreatDown). Those apps make standard time-based codes, and ThreatDown says its codes change every 30 seconds, which is what Novaz produces too (ThreatDown).
Set up the authenticator app
There's no switch to hunt for. If your account has neither 2FA nor SSO, OneView starts the setup when you sign in (ThreatDown). ThreatDown doesn't show the setup screens, but it says you need a phone with a camera, so expect a QR code (ThreatDown).
- On the OneView sign-in page (oneview.threatdown.com), enter your email address and password.
- When OneView asks you to set up two-factor authentication, keep that page open on your computer.
- In Novaz, tap +, then Scan QR code, and point the camera at the code. Signing in on the same iPhone? Take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- If OneView asks for a code to confirm, type the one Novaz shows now.
The help pages don't mention a text key. If the screen offers one, Novaz accepts it under + > Enter key manually (What is a 2FA setup key?), but scanning is safer because the QR code carries the code settings.
No backup codes, but an emailed recovery code
ThreatDown's pages don't describe a list of backup codes. The fallback is a one-time recovery code sent by email, and only if a Global Administrator has turned it on in advance: Configure > Users > the Two-factor authentication button > Allow the recovery code to be sent via email (ThreatDown).
ThreatDown admits the trade-off: someone who takes over a user's mailbox could use it to get past 2FA. So each user's recovery address must be on a different domain from their OneView login email. OneView asks for it at sign-in, and you can change it under 2FA recovery email in your profile's Security Settings (ThreatDown).
A Novaz iCloud backup or backup file can bring your codes to a new iPhone, but without one the keys exist only on your phone. For OneView, your safety net beyond that is this recovery email plus a second Global Administrator.
If OneView rejects your code
The code comes right after your password. ThreatDown's troubleshooting page covers two errors (ThreatDown):
- Code is incorrect or expired: the code went in after its 30 seconds ran out. Sync your phone's clock and type the newest code. On iPhone: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off.
- Session timed out: the session expired after your password. The computer you sign in on needs the same time as your phone, so fix its clock and sign in again.
Still stuck? Another Global Administrator can reset your 2FA, or contact ThreatDown Support. More in Authenticator code not working?
Moving to a new phone
Do it while you can still sign in: click your display name in the top-right, choose Profile, open the Security Settings tab and click Reset 2FA (ThreatDown). The profile help page calls this Reset Two-Factor Authentication Settings, so the label may differ (ThreatDown). With a Novaz iCloud backup or backup file, you can restore OneView on the new iPhone instead; without one, add it to the new phone from scratch. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Try these in order (ThreatDown):
- Emailed recovery code, if the setting was on and your recovery address was set. On the sign-in page, enter your email and password, click Request recovery code, type the code from the email and click Submit.
- Another Global Administrator. In Configure > Users, they click the ellipsis icon next to your name and choose Reset 2FA. Since 2FA is required, expect to set it up again at your next sign-in. ThreatDown recommends at least two Global Administrator accounts so each can reset the other.
- ThreatDown Support, when no other admin can help. The help pages don't say what proof Support needs or how long it takes.
More in Lost the phone with your authenticator app?
Turning it off
You can't, except by moving to SSO. The release notes say SSO through Okta, Azure AD or another SAML 2.0 provider meets the requirement (ThreatDown), and the SSO page puts it plainly: "Manually enabling SSO disables MFA." (ThreatDown). Your identity provider then handles the second step.
