Skip to content
Novaz AuthenticatorGET

NetSuite 2FA: how to set up an authenticator app

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Who has to use it
  2. Set up Novaz at your first 2FA login
  3. Backup codes
  4. When NetSuite asks for a code
  5. If NetSuite rejects your code
  6. Moving to a new iPhone
  7. If you lose your authenticator
  8. Turning 2FA off
  9. Official NetSuite help

Oracle NetSuite is the cloud business system many companies run their accounting and orders on. You won't find a two-factor authentication (2FA) switch in your own NetSuite preferences: it's tied to roles, and once the role you log in with is marked as 2FA-required, NetSuite takes you through the setup (NetSuite). The second step is a code from an authenticator app, with one-time backup codes for emergencies. Since NetSuite 2026.2, a FIDO2 passkey can also stand in for the code (NetSuite). This guide uses Authenticator App - Novaz on iPhone. Any app that makes standard time-based (TOTP) codes works the same way (NetSuite).

How we checked this guide: the NetSuite steps come from NetSuite's own online help on Oracle's documentation site, linked below, which we read on October 21, 2026. We haven't tested them on a NetSuite account, and your company's settings change what you see, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Who has to use it

Your company's NetSuite administrator decides, role by role (NetSuite):

  • Administrator and other highly privileged roles: always. NetSuite has enforced this in every account since 2018.2, sandboxes included, and it can't be switched off (NetSuite).
  • Other employee, vendor and partner roles: when the administrator marks the role as 2FA-required, or turns on Require 2FA for All Roles for the whole account (NetSuite).
  • Customer Center roles: never.
  • Single sign-on: if you log in through SAML or OpenID Connect, that takes priority and NetSuite's own 2FA is skipped (NetSuite).

No setup screen? You may be in a role that doesn't need 2FA. Switch roles or ask your administrator.

Set up Novaz at your first 2FA login

Use a computer: the first setup can't be done in the NetSuite mobile app (NetSuite). That suits Novaz, since the iPhone can scan the QR code straight off the screen.

  1. Log in with your email address and password, choosing the 2FA-required role.
  2. The first time, NetSuite emails you a verification code. Enter it.
  3. On the Security setup page, click Next. Skip to NetSuite puts it off, but only five times.
  4. NetSuite shows a QR code with a string of characters beside it. In Novaz, tap +, then Scan QR code, and point the camera at the screen.
  5. To type it instead, tap +, then Enter key manually, and enter that string as the Setup key. NetSuite doesn't document the key length or code format, so scanning is safer: the QR code carries those settings. See What is a 2FA setup key?
  6. Enter the code from Novaz and click Next. Codes refresh about every 30 seconds.
  7. Save the ten backup codes NetSuite displays (Print gives a paper copy), then click Next.

The Settings portlet on your Home page now has links to reset 2FA and make new backup codes (NetSuite). NetSuite also advises against keeping the authenticator on the device you log in to NetSuite with (NetSuite), which matters if you use the NetSuite app on the same iPhone.

Backup codes

Each of the ten works once, never expires, and triggers an email when used. They're shown only once, and NetSuite wants them kept apart from your phone and from the device you log in on (NetSuite). Without a Novaz backup, its keys exist only on your iPhone, so these codes are your way back in if that iPhone is gone.

For a new set, click Generate Backup Codes in the Settings portlet (the setup page says Generate Backup Code), enter your password, then click Generate. The old set stops working. See 2FA backup codes.

When NetSuite asks for a code

At every login with a 2FA-required role. The Trust this device for ... box on the code page skips the prompt on that device for a period your administrator picks: 4 hours to 30 days, or one session by default (NetSuite). Undo it under Manage Trusted Devices in the Settings portlet (NetSuite).

Switching roles in a valid session doesn't ask again, even for a role at another company (NetSuite). If you use a passkey for 2FA, NetSuite still wants an authenticator code every three months, so keep Novaz set up (NetSuite).

If NetSuite rejects your code

Don't keep trying: five failed attempts lock you out. If you need in now, switch to a backup code with the link on the code page (NetSuite).

NetSuite's own advice is to check the phone's time (NetSuite). On iPhone: Settings > General > Date & Time > Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. If that doesn't fix it, NetSuite suggests resetting your 2FA, and then your administrator. More in Authenticator code not working?

Moving to a new iPhone

There's no transfer: you clear your 2FA settings and start over, ideally while you still have the old phone (NetSuite):

  1. In the Settings portlet, click Reset 2FA Settings.
  2. Enter your password, plus a code or backup code if asked, and click Reset. NetSuite emails a confirmation.
  3. Log out, log back in with your 2FA role, enter the emailed verification code, click Submit, and repeat the setup with Novaz on the new iPhone.

If you've made a Novaz iCloud backup or backup file, though, you can restore your accounts on the new iPhone and skip the reset. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

With a backup code, log in and use Reset 2FA Settings as soon as you can (NetSuite). If you'd trusted the lost phone, also remove it under Manage Trusted Devices (NetSuite).

Without one, ask your company's NetSuite administrator. They open Setup > Users/Roles > User Management > User Access Reset Tool, enters your email address, checks Reset 2FA Settings and clicks Save. You set up 2FA again at your next login (NetSuite). NetSuite's help doesn't say what proof your administrator should ask for or how long it takes. See Lost the phone with your authenticator app?

Turning 2FA off

You can't. Reset 2FA Settings only clears your setup, and NetSuite prompts you again the next time you use a 2FA role. Whether a role needs 2FA is your administrator's call, except for Administrator and highly privileged roles, where it's permanent.

Official NetSuite help

More guides: Payments, accounting and insurance