McGill University 2FA: how to set up an authenticator app

Your McGill username and password open Office 365, Minerva and many other McGill web systems, and two-factor authentication (2FA) protects that sign-in (McGill, McGill). It's mandatory for faculty, staff and students. Retirees and alumni can opt in, and must set it up if their account was locked for security reasons.

McGill's setup article walks through Microsoft Authenticator, its preferred method, but says you may use another authenticator app, such as Google Authenticator or OneAuth. It also notes that Microsoft retires text-message and phone-call 2FA on January 28, 2027, so an app is the method you won't have to replace (McGill). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the McGill steps come from McGill's own IT pages, linked below, which we read on October 20, 2026. McGill's IT knowledge base doesn't return its article text to a plain page request, so we read its two articles in archived copies on web.archive.org, saved on October 4, 2026 (setup) and April 30, 2026 (Service Desk). We haven't tested the steps on a McGill account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Add Novaz to your McGill account

McGill's steps start on a computer, which keeps the QR code off your iPhone. Allow 10 to 15 minutes during business hours, in case you need help (McGill).

1. On the computer, go to mysignins.microsoft.com/security-info and sign in with your McGill username and password.
2. If a More Information Required pop-up appears, click Next.
3. Click Add sign-in method.
4. From the drop-down menu, pick Authenticator App and click Next.
5. Microsoft now steers you to its own app. McGill's article follows that path and doesn't name the switch to a different app, so look for the option to use another authenticator app and follow it to the QR code.
6. In Novaz, tap +, then Scan QR code, and point the camera at the screen. If the QR code is on your iPhone, screenshot it and use Choose a photo (how).
7. If the scan fails, McGill says to click Can't scan image? and follow the prompts. With a text key, tap +, then Enter key manually in Novaz, fill in Service, and paste the key into Setup key (What is a 2FA setup key?).
8. When asked, type the current code from Novaz and finish the remaining screens.

McGill doesn't give its code length or interval. A QR code carries both into Novaz, while a typed key always gets 6 digits every 30 seconds, so scan if you can.

Retirees and alumni: sign out of all Microsoft 365 web apps, complete the form on McGill's Enroll in 2FA page, wait a few minutes, then follow the steps above (McGill). After enrolling you can change methods but can't opt out, so there's no off switch for anyone (McGill).

When McGill asks for a code

Expect a prompt when you sign in to Office 365 and many other McGill web apps, but not on the McGill Wi-Fi network, where 2FA isn't required. So to test your setup, McGill suggests signing in at office.com off campus, or on your phone with Wi-Fi off (McGill).

If Microsoft Authenticator is also on your account, the sign-in offers it first. You can still pick another method, such as your Novaz code (McGill).

Set up a second method

McGill's pages don't mention backup codes. Instead, McGill has you add a secondary method for when the main one is unavailable (McGill). The choices in its article are Text me a Code, Call me and I want to set up a different method. For people without a phone, McGill points to OneAuth, an authenticator for a desktop or laptop (McGill, McGill).

Without a Novaz iCloud backup or backup file, its keys exist only on your iPhone, so pick a second method that works without that phone, keeping in mind that texts and calls end on January 28, 2027.

It also matters for passwords: Self-Service Password Reset (SSPR) asks for two of your methods before you can set a new McGill password (McGill). Email and security questions count for password resets only, not for signing in (McGill).

If McGill rejects your code

McGill's articles don't cover rejected app codes. Check the iPhone's clock first: Settings > General > Date & Time > Set Automatically. Novaz warns you when it's 15 seconds or more off. More causes in Authenticator code not working?

Moving to a new iPhone

The McGill pages we could read don't describe switching phones. If you have a Novaz iCloud backup or backup file, restore it on the new iPhone. Without one, run the steps above on the new phone while the old one still gives codes. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Sign in with your secondary method and set up Novaz again. Without one, contact the IT Service Desk. It won't reset 2FA methods by email or chat: staff must verify your identity by phone, at a virtual walk-in, or in person (McGill). As of April 2026:

• Phone: 514-398-3398, or 1-833-576-0159 toll-free in North America. Monday to Thursday 8:00 a.m. to 6:30 p.m., Friday until 5:00 p.m. (Eastern).
• Virtual walk-in: 30-minute appointments, weekdays 9:00 a.m. to 5:00 p.m., booked up to five days ahead at mcgill.ca/itwalkin. Use a non-McGill email address so the meeting link reaches you.
• In person: McLennan Library, 3459 McTavish St., main floor, weekdays 9:00 a.m. to 5:00 p.m.

McGill doesn't say what proof of identity it asks for or how long a reset takes. See Lost the phone with your authenticator app?

Official McGill help

• Two-Factor Authentication (2FA): Setup Instructions
• Contact the IT Service Desk
• Two-factor authentication (2FA)
• Enroll in 2FA
• McGill Password Reset Checklist
• NOW LIVE: Minerva's login page has been updated to implement 2FA and SSO.