Skip to content
Novaz AuthenticatorGET

Microsoft work or school account 2FA: how to set up an authenticator app

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. What your admin decides
  2. Turn on 2FA with an authenticator app
  3. Signing in
  4. No backup codes, so add another method
  5. If your code is rejected
  6. Changing phones
  7. If you lose your authenticator
  8. Turning it off
  9. Official Microsoft help

A work or school account is the Microsoft sign-in your employer or school gives you, for Microsoft 365, Teams or the Azure portal. It runs on Microsoft Entra ID, and your organization sets the rules. You may not be able to turn two-step verification off, but you can choose among the methods it allows (Microsoft).

Microsoft's setup screens lead with Microsoft Authenticator, but a link lets you pick a different app. This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way. Personal Microsoft accounts, such as Outlook.com addresses, are set up at account.microsoft.com/security instead (Microsoft).

How we checked this guide: the Microsoft steps come from Microsoft's own support articles and its Microsoft Learn pages for admins, linked below, which we read on October 20, 2026. We haven't tested them on a work or school account, and your organization's settings change what you see, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

What your admin decides

  • Other apps are on by default, as third-party software OATH tokens, but an admin can switch them off (Microsoft). A message that you might be signing in from a restricted location means your admin hasn't allowed it (Microsoft).
  • Security defaults, Microsoft's baseline settings, expect you to register Microsoft Authenticator with notifications, though other apps can still make codes (Microsoft).
  • Azure phased in required multifactor authentication: for the Azure portal from October 2024, and for changes made with Azure CLI or Azure PowerShell from October 1, 2025 (Microsoft).

Turn on 2FA with an authenticator app

Microsoft's Authenticator article gives this path (Microsoft). Use a computer, so the QR code isn't on your iPhone.

  1. Go to mysignins.microsoft.com/security-info and sign in.
  2. Select Add sign-in method.
  3. Choose Microsoft Authenticator from the list and select Add.
  4. Select I want to use a different authenticator app and follow the screens to the QR code.
  5. In Novaz, tap +, then Scan QR code. If the code is on the same iPhone, take a screenshot and use Choose a photo (see how).
  6. If Microsoft asks for a code, type the current one from Novaz.

Microsoft documents its Can't scan the QR image link (elsewhere Can't scan the image) only for its own app, which gets a code and a URL (Microsoft). It doesn't say what other apps get or which code settings they use, so scan if you can: the QR code carries the settings into Novaz. With only a text key, tap +, then Enter key manually, and type it as the Setup key (What is a 2FA setup key?).

If setup starts right after you sign in, select Next. The Keep your account secure wizard has the same I want to use a different authenticator app link, and may also ask for a phone number (Microsoft).

To make Novaz your usual method, select Change next to Default sign-in method on Security info, pick the authenticator app and select Confirm (Microsoft).

Signing in

After your password, type the Novaz code in Enter code (Microsoft). If you're asked to approve a request in Microsoft Authenticator instead, select Use a verification code (Microsoft) or Sign in another way.

Your organization decides how often you're asked. Don't ask again for X days, if offered, covers one browser only: another browser or cleared cookies bring the prompt back (Microsoft).

No backup codes, so add another method

Microsoft's work and school pages don't mention backup codes. Instead, it says "we strongly recommend you have three different sign-in methods" (Microsoft). Email and security questions don't count: they only work for password resets (Microsoft). Without a Novaz iCloud backup or backup file, its keys exist only on your iPhone, so also add a phone or security key if your organization allows it.

If your code is rejected

Microsoft's help doesn't cover refused app codes. Check the iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when it's 15 seconds or more off. More causes: Authenticator code not working?

Changing phones

Microsoft doesn't describe a phone switch for other apps. While the old iPhone still works, add Novaz on the new one with the steps above, then select Delete next to the old entry on Security info and confirm with Yes (Microsoft). The troubleshooting page calls that button Remove. With a Novaz iCloud backup or backup file, you can restore the account on the new iPhone instead and keep the existing entry (how to plan for it).

If you lose your authenticator

  1. At the code prompt, choose Sign in another way and use another method (Microsoft). Then remove the lost entry on Security info and set up Novaz again (Microsoft).
  2. With no other method, Microsoft sends you to your administrator (Microsoft): your school's tech support, your company's help desk, or whoever gave you the account (Microsoft).

Your admin can use Require re-register MFA, which deletes your phone numbers and authenticator apps so you set up afresh at your next sign-in (Microsoft). Microsoft doesn't say what proof your organization will ask for or how long it takes. More in Lost the phone with your authenticator app?

Turning it off

That's your organization's call (Microsoft). You can delete the app on Security info, but if two-step verification is required, you'll need another method. Remove account in Novaz changes nothing at Microsoft.

Official Microsoft help

More guides: Hosting and cloud