Masaryk University 2FA: how to set up an authenticator app for MUNI Unified Login

MUNI Unified Login is where Masaryk University students and staff sign in to many university web services with their UČO and primary password (MUNI). Its multi-factor authentication (MFA) accepts codes from an authenticator app and security keys such as Windows Hello, Touch ID or your phone. The order is fixed: a time-based code token (TOTP) is the first method everyone sets up (MUNI), and a security key can only be added after it and your backup codes exist (MUNI).

This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Masaryk University steps come from MUNI's own IT help pages and the Perun documentation they link to, listed below, which we read in English and Czech on October 20, 2026 (the IS MU help page in archived copies). We haven't tested them on a MUNI account, so a label may differ slightly, and the screens may appear in Czech. The Novaz steps are checked against the app, version 1.0.5.

Add the verification code token

The same steps cover your first app and any app or device you add later (MUNI):

1. On a computer if you can, open mfa.id.muni.cz, select Log in and sign in.
2. Select I have an authentication app, type a description for the token (a name only you see), and select Continue. MUNI's English and Czech pages put these two screens in a different order.
3. A QR code appears. In Novaz, tap +, then Scan QR code. If the code is on your iPhone's own screen, take a screenshot, tap +, then Choose a photo (how that works).
4. Type the code from Novaz and select Verify token.
5. On a first setup, select Continue, then OK. MFA is now on for every service behind MUNI Unified Login.
6. Save your backup codes with Save or Print, then select I have backup codes.
7. Select Log out, or Service Settings to limit MFA to some services.

In Czech, the main buttons are Mám aplikaci pro ověření, Pokračovat, Ověřit token and Záložní kódy mám.

MUNI only describes scanning. It doesn't mention a key you could type, or how many digits and seconds its codes use, so scan the QR code.

Backup codes

Each backup code works once. When you run low, sign in to mfa.id.muni.cz, select Enroll Token, choose backup codes as the type, and download or print a new set (MUNI). MUNI doesn't say whether that cancels the old set.

Unless you back up Novaz with iCloud backup or a backup file, its keys live only on your iPhone, so keep these codes as your fallback. MUNI also strongly recommends registering at least two devices (MUNI). More in 2FA backup codes.

When MUNI asks for a code

With MFA on, you need your device whenever you sign in from a new device (MUNI). Some services require it only for selected actions, others for every sign-in (MUNI). To choose services yourself, open account.muni.cz, go to Authentication > Multi-factor authentication, switch the service categories you want, select Save setting, then sign out (MUNI).

Keep Novaz even after adding Face ID or a security key. MUNI says Microsoft Teams and other Microsoft 365 apps sign in through a built-in browser where security keys and biometrics fail, and on iPhone, Android and macOS, authenticator codes are the only method that currently works there (MUNI).

The IS MU has its own 2FA

MFA on MUNI Unified Login doesn't cover the MU Information System (MUNI). Its setting is under Settings (gear icon, bottom right) > Two-factor account verification (Czech: Dvoufaktorové ověřování účtu). It offers an authenticator app (TOTP) among other methods and lets you type the key as text instead of scanning (IS MU). That page shows a browser check to automated readers, so we read archived copies (Czech from May 14, 2026, English from June 19, 2025). If you use both systems, Novaz holds two entries, and each code only works in its own system.

If a code is rejected

MUNI's pages don't cover rejected codes. Check that you picked the right Novaz entry, then check your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More in Authenticator code not working?

New iPhone

If you have a Novaz iCloud backup or backup file, restore it on the new iPhone and your MUNI token keeps working (details). Without one, run the setup again with Novaz on the new phone while the old one still works, then remove the old token in mfa.id.muni.cz: select its serial number, then Delete. That step comes from the Perun documentation MUNI links to (Perun).

If you lose your phone

Sign in with a backup code, then add a new token at mfa.id.muni.cz (MUNI). With no backup codes or other registered device, contact IT MUNI user support through Report an Incident. If you can't sign in there, email it@muni.cz with your UČO, the service's link, the time, the error message, and your browser and system versions. MUNI doesn't say what proof it needs or how long it takes. See Lost the phone with your authenticator app?

Turning MFA off

At account.muni.cz, under Authentication > Multi-factor authentication, clear Turn on multi-factor authentication for all services and select Save settings (MUNI's page says Save setting). You may need one last code. Services that enforce MFA themselves still ask for it, so deleting every token locks you out of them (Perun).

Official Masaryk University help

• Multi-Factor Authentication
• Setting up Authentication with Verification Codes (both first and additional apps or devices)
• How to Generate Backup Codes
• How to Enable Multi-Factor Authentication for Selected Services
• Adding a Security Key
• How to Sign In
• How to deactivate MFA (deactivate MFA in all services, delete tokens), Perun documentation linked from MUNI's page
• Přístup k systému (IS MU help, "Accessing the System" in English; read in archived copies from May 14, 2026 and June 19, 2025)