Check Point SASE (Perimeter 81) 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Perimeter 81 is now Check Point SASE. It's the business VPN and zero-trust access service many companies use to reach internal apps, and you sign in to it through the SASE Agent with your company's workspace name (Check Point). The old Perimeter 81 help article on two-factor authentication now redirects to Check Point's SASE Administration Guide.
The thing to know first: you can't switch two-factor authentication (2FA) on for yourself. An administrator turns it on for a whole sign-in method, and Check Point says "2FA is configured per Identity Provider", not per person (Check Point). The admin picks one of two methods: an authenticator app or Duo Security. This guide covers the authenticator app, using Authenticator App - Novaz on iPhone. Any authenticator app works the same way.
How we checked this guide: the Check Point SASE steps come from Check Point's SASE Administration Guide, linked below, which we read on October 21, 2026. The member side of the setup is only described on the former Perimeter 81 help article, which now redirects, so we read it in an archived copy on web.archive.org (captured May 9, 2026). We haven't tested any of this on a Check Point SASE workspace, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
How your admin turns it on
If you're the administrator, Check Point lists these steps (Check Point):
- Open the Check Point SASE Administrator Portal and go to Settings > Identity Providers.
- Next to the identity provider your members sign in with, click Turn On for Two-Factor Authentication.
- Under Choose 2FA type, select Google Authenticator. Despite the name, this is the authenticator app option. The old Perimeter 81 article called it TOTP Authenticator (Perimeter 81, archived). The other choice, Duo Security, sends members through Duo instead and won't use Novaz.
- Under Authentication requests, choose Every Login or Once in 30 days.
- Click Done.
If you're a member and your company picked Duo, this guide doesn't apply to you: ask your admin which method your workspace uses.
Set up Novaz the first time you sign in
Once the admin has turned it on, the setup happens at your next sign-in. The archived Perimeter 81 article says members signing in for the first time are asked to scan a QR code (Perimeter 81, archived). Check Point's current guide doesn't describe the member's screens, so the labels you see may differ.
- Sign in to the SASE Agent with your workspace name and your usual credentials.
- When the QR code appears, open Novaz, tap +, then Scan QR code, and point the camera at it.
- If the QR code is on your iPhone's own screen, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- Type the code Novaz shows to finish signing in.
Check Point doesn't say whether a text key is offered in place of the QR code, or how many digits and seconds its codes use. Scan the QR code if you can, since it carries those settings to Novaz.
When you'll be asked for a code
That depends on your admin's choice: at Every Login, or Once in 30 days (Check Point).
No backup codes
Neither the current Check Point pages nor the archived Perimeter 81 article mention backup or recovery codes. The documented way back in is an administrator reset (below). Unless you've made a Novaz backup, its keys exist only on your iPhone, so if that phone is gone, you'll need your admin.
If your code is rejected
Check Point doesn't give advice for rejected codes. Start with your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. If the code still fails, your setup may be out of date after a reset, and your admin can reset it again. More causes are in Authenticator code not working?
New phone or lost phone: ask your admin
Check Point says that when a member moves to a new device, an administrator has to reset their two-factor authentication (Check Point). The same reset is the route if you've lost your phone. For the admin:
- In the Administrator Portal, click Team > Members.
- Click the member's row to open Edit Member.
- Click Reset Database 2FA, then Reset.
The member gets an email confirming the reset, with a link to set up 2FA again. Check Point doesn't say what proof an admin should ask for before resetting; that's up to your company.
With Novaz's iCloud backup or a backup file, you can restore your accounts on the new iPhone. Without one, a new phone means scanning a fresh QR code after the reset. See How to transfer your authenticator app to a new iPhone and Lost the phone with your authenticator app?
Turning 2FA off
Only an admin can, and only for a whole identity provider: in Settings > Identity Providers, click Turn Off for Two-Factor Authentication, then Deactivate (Check Point). After that, you can remove the entry from Novaz: open it and tap Remove account.
