Monash University 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Your Monash account is the email address and password you use for the Student Portal, the Staff Portal and other University systems, and you can't log in without multi-factor authentication (MFA). Monash offers Okta Verify, which it strongly recommends, a YubiKey, and "Google Authenticator or other compatible authenticator app" for six-digit codes (Monash). This guide uses Authenticator App - Novaz on iPhone for that last option. Any authenticator app works the same way.
How we checked this guide: the Monash University steps come from the eSolutions help pages, linked below. Those pages blocked our automated reader, so on October 20, 2026 we read archived copies on web.archive.org, saved between January and October 2026 (one older page, saved in 2023, is marked where we use it). We haven't tested the steps on a Monash account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Before you start
- New accounts start with Okta Verify. You can't pick an authenticator app at first activation, only later, as an extra factor or when you set MFA up again (Monash).
- Monash suggests both. Okta Verify works on only one device, so Monash recommends adding an authenticator app too, ideally on a second phone.
- A YubiKey rules out the apps. After you register one, switching to an app goes through the Service Desk.
- Novaz only makes codes. It can't approve Okta Verify push notifications.
- Logging in from China? Monash has separate setup steps for that.
Add an authenticator app to your Monash account
If you can already log in, use the Identity portal (Monash, Monash):
- Go to identity.monash.edu/mfa and verify with your current MFA method.
- Select MFA from the menu on the left.
- Click Setup for Google Authenticator. Monash shows a QR code.
- In Novaz, tap +, then Scan QR code. If the QR code is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
- Type the six-digit code from Novaz to finish. Monash warns that skipping this step leaves the app unusable for logging in.
Monash's pages don't mention a text key. If one appears, use Enter key manually in Novaz and paste it as the Setup key (What is a 2FA setup key?). Codes are six digits and change every 30 seconds, which matches a typed key (Monash).
Monash shows the Setup button only in its steps for shared custom accounts, but personal accounts use the same portal.
Set MFA up again without Okta Verify
If you're setting up MFA again and can't use Okta Verify, Monash's MFA page gives this route (Monash):
- Open identity.monash.edu/activation/mfa/OKTA and click I can't install Okta Verify.
- Choose Apple or Google / Android, then click I already have Google Authenticator.
- Follow the prompts. When Monash shows a QR code, add it to Novaz as above.
Monash's help doesn't show the screens after that button.
Shared custom accounts
Staff sharing a custom account scan a QR code the primary owner prints, and Monash says never to keep a digital copy of it (Monash). Scan the paper with Scan QR code, not a screenshot.
Get backup codes now
Backup codes let you reset MFA without calling the Service Desk (Monash). Go to identity.monash.edu/backup-codes, click Generate my backup codes, and email, print or download them. Each works once. Without a Novaz iCloud backup or backup file, its keys exist only on your iPhone, so these codes are your way back in. See 2FA backup codes.
When Monash asks for a code
You verify when you log in from a new device, a new web browser or a new country (Monash). Click Select next to Google Authenticator, type the code from Novaz and click Verify (Monash). An older page, saved in 2023, mentions a Do not challenge me on this device again checkbox, and says VPN asks every time (Monash).
If Monash rejects your code
That older page says codes fail when your phone's date and time don't match where you are, which matters when you travel (Monash). On iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?
New iPhone
With the old phone still in hand, go to the Identity portal, select MFA, click Reset next to Google Authenticator, and follow the prompts on the new phone (Monash). Monash strongly recommends getting backup codes afterwards. If you have a Novaz iCloud backup or backup file, you can restore the account on the new iPhone instead of resetting. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
- With backup codes: open identity.monash.edu/mfa-reset, click Continue, and sign in with your Monash email and password. Click Verify next to Backup Codes, enter an unused code, then click Reset next to Google Authenticator (Monash). If the tool shows a blank page, try a private window.
- Without them: call the Service Desk on +61 3 9903 2777 (students) or +61 3 9905 1777 (staff), 8am to 6pm Melbourne time, weekdays, or request a callback. Don't email from a non-Monash address (Monash). Monash checks who you are in a short Zoom call where you show your M-Pass or a photo ID, such as a passport or driver licence. You send no documents, and Monash says it takes a few minutes (Monash).
More in Lost the phone with your authenticator app?
