Skip to content
Novaz AuthenticatorGET

Mimecast 2FA: how to set up an authenticator app

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Register Novaz when Mimecast asks
  2. For admins: turning on the app method
  3. When Mimecast asks for a code
  4. No backup codes
  5. If Mimecast rejects your code
  6. Lost phone or new phone
  7. Turning it off
  8. Official Mimecast help

You have a Mimecast login only if your employer uses Mimecast for its email: for the Personal Portal, Mimecast for Outlook, Mimecast Mobile, Mimecast for Mac, or, for admins, the Administration Console. Mimecast's two-step authentication covers all of them (Mimecast).

There's no switch for it in your own settings. Your organization's Mimecast admins turn it on for groups of users and decide whether the code comes from an authenticator app, an email or a text message (Mimecast). Mimecast recommends the app (Mimecast). Once it's on for you, you register your app at your next sign-in. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the Mimecast steps come from Mimecast's own support knowledge base, linked below, which we read on October 21, 2026. We haven't tested them on a Mimecast account, and your organization's settings decide what you see, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Register Novaz when Mimecast asks

  1. Sign in as usual: your email address, Next, Use Cloud Password or Use Domain Password, your password, then Login (Mimecast).
  2. If your admins chose the app method, the Register for 2-Step Authentication screen appears with a QR code (Mimecast).
  3. In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
  4. Mimecast's screenshot also shows a Can't scan the code? link, which its help doesn't explain. If it gives you a key, tap + in Novaz, then Enter key manually, and type it as the Setup key. See What is a 2FA setup key?
  5. Select Next, type the six-digit code from Novaz as the Verification Code, and finish signing in.

Mimecast then emails you a confirmation, which admins can't turn off (Mimecast), so if one arrives when you didn't register anything, tell your IT team.

Mimecast doesn't say how often its codes change, so scan the QR code if you can: it passes the code settings to your app.

Admins on Email Security Cloud Integrated work differently. An admin set to Local Password always has 2FA: you get a temporary password by email, then at first sign-in you choose a new password and scan a QR code. Admins set to M365 sign in with Microsoft 365 instead (Mimecast).

For admins: turning on the app method

In the Administration Console (Mimecast):

  1. Go to Users & Groups | Applications and click Authentication Profiles.
  2. Open a profile, or click New Authentication Profile.
  3. Set Two-Step Authentication to 3rd Party App, then click Save and Exit.
  4. In the group's application settings (or New Application Settings), choose the profile under Authentication Profile (Mimecast).

Worth knowing first:

  • The default admin profile, Account_Administrators_Authentication_Profile, overrides every other profile for administrators. If it uses SMS, admins get texts whatever their group's profile says (Mimecast).
  • If the same profile enforces SAML, SAML wins (Mimecast).
  • Admins on the app method can't create API keys. Mimecast won't fix this and suggests email or SMS codes, or an IP bypass, instead (Mimecast).

When Mimecast asks for a code

Everyone the profile covers types a code each time they sign in to Mimecast's apps. Admins can use Disable 2-Step Authentication for Trusted IP Ranges to skip the code on the office network, though Mimecast for Outlook ignores that from version 7.10 (Mimecast).

No backup codes

Mimecast's pages don't mention backup or recovery codes. It tells you to keep the authenticator on your phone, "as you'll need it each time you log in" (Mimecast). Unless you've turned on iCloud backup or exported a backup file, Novaz keeps the key only on your iPhone, so without that phone, your IT team is the only way back in.

If Mimecast rejects your code

Mimecast's overview says its check allows for a clock that's off by about a minute either way (Mimecast). So check for a bigger gap first: Settings > General > Date & Time > Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?

Lost phone or new phone

Tell your IT department right away. They can make you register again (Mimecast). The admin does it like this (Mimecast):

  1. Go to Users & Groups | Directories | Internal Directories and click the user's domain, then the user. That's the newest page's path; the older re-registration page starts at Directories (Mimecast).
  2. In the 2-Step Authentication section, click Force Reregistration, then Save and Exit.

That deletes your old secret, and your next sign-in shows the Register for 2-Step Authentication screen again. Mimecast doesn't say what proof IT should ask for.

On Cloud Integrated, a Super Administrator resets the admin's local password under Configuration | Admin Management to get a new QR code. Can't log in? on the sign-in screen won't produce one (Mimecast).

With a Novaz iCloud backup or backup file, you can restore the account on a new iPhone and skip this reset; without one, a new phone means this reset too. See How to transfer your authenticator app to a new iPhone and Lost the phone with your authenticator app?

Turning it off

Only admins can, by setting Two-Step Authentication to None in the profile. Mimecast notes that Mimecast for Outlook 7.10 needs a two-step method, so None isn't available for it (Mimecast).

Official Mimecast help

More guides: Email