OneLogin 2FA: how to set up an authenticator app for your work portal

OneLogin is the single sign-on portal some companies use for work apps, at an address like yourdomain.onelogin.com. Your employer decides how sign-in works: an admin picks the second factors, such as OneLogin Protect, SMS, email, security keys or an Authenticator factor, and attaches them to a user policy (OneLogin). The Authenticator factor is the one that works with a code-generating app. OneLogin's help names Microsoft and Google Authenticator, but its developer documentation describes the factor as standard time-based codes (TOTP) (OneLogin). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the OneLogin steps come from OneLogin's own knowledge base and developer documentation, linked below, which we read on October 21, 2026. Pages on support.onelogin.com block automated access, so we read those in archived copies on web.archive.org. We haven't tested anything on a OneLogin account, and your company's settings change what you see, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Can you use an authenticator app at all?

Only if your company allows it. If Authenticator isn't offered when you add a factor, it hasn't been set up or assigned to your policy, and OneLogin says to ask your administrator (OneLogin).

OneLogin Protect is OneLogin's own app, and it can send push notifications (OneLogin). Novaz can't stand in for it. If your company only offers Protect, use Protect.

Add the Authenticator factor

If your policy requires a second factor, OneLogin asks you to register one the first time you sign in. Otherwise, you can add it later from your profile (OneLogin, OneLogin):

1. Sign in to your OneLogin portal. Click your name or picture in the top-right corner and open your profile, then Security Factors. The direct address is yourdomain.onelogin.com/profile2/mfa.
2. Click Add factor. If it's grayed out, you've already set up every factor you're allowed.
3. Choose Authenticator. Your admin may have renamed it, so look for the name your company uses.
4. OneLogin shows a QR code. In Novaz, tap +, then Scan QR code. If the code is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
5. Type the code from Novaz into OneLogin and click Continue.

The factor then appears in your Security Factors list. Step 5 comes from an older version of the same article, which says sign-in codes are 6 characters and writes Add Factor with a capital F, so labels may differ (OneLogin). OneLogin's pages only describe scanning a QR code and don't mention a text key, so plan to scan.

When OneLogin asks for a code

Your company's policy decides. It may be every time, or only in some cases, such as a browser OneLogin doesn't know (OneLogin). Admins can also skip the second step for trusted devices or certain IP addresses (OneLogin).

If you've set up more than one factor, you can choose which one OneLogin offers first. Open the three-dot menu on a factor and select Set as primary (OneLogin).

No backup codes

OneLogin's end-user pages don't mention backup codes. Without a Novaz backup your key exists only on your iPhone, so a second factor is your safety net, and OneLogin's support team advises admins to allow at least two (OneLogin). If Add factor still works for you after setup, add another method.

If OneLogin rejects your code

OneLogin's support article on this traces rejected codes to a phone clock that drifted because automatic time was off. Turning automatic date and time on fixed it (OneLogin). On iPhone, go to Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?

Moving to a new iPhone

You can't edit a factor once it exists. OneLogin's profile help says that on a new phone you delete the old factor and enroll again (OneLogin). First make sure you can still sign in another way, such as another factor or the old phone (OneLogin). With a Novaz iCloud backup or backup file, you can restore OneLogin on the new iPhone instead; otherwise you add it to the new phone from scratch. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Sign in with another factor if you have one. Then remove the lost one under Security Factors: open its menu and click Remove (OneLogin).

With no other factor, contact your company's help desk. An admin can create a Temporary token from your user record: a one-time code that expires after a set time or one use, so you can get in and set up your factors again (OneLogin). OneLogin doesn't describe what proof your help desk will ask for or how long it takes. That's up to your company. More in Lost the phone with your authenticator app?

Removing the factor

Use the same Remove option. If it was your primary factor, OneLogin asks you to set up a new one (OneLogin). Then tap Remove account on the account in Novaz.

Official OneLogin help

• Authenticating with Microsoft or Google Authenticator
• Authenticator (older version of the same article)
• Your User Profile
• Multi-Factor Authentication
• Add Multi-Factor Authentication (read in an archived copy)
• OneLogin - MFA Not Working Due to Phone Time Settings (read in an archived copy)
• OneLogin - OneLogin Protect MFA (auth factor) cannot be used after the user changed or updated his device (read in an archived copy)
• Get Available Factors