Principal 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Your Principal account is the online login at principal.com for Principal Financial Group products, such as a workplace 401(k), an IRA, an annuity, or employee benefits. Here, a second step isn't optional. Principal's help states that "multi-factor authentication (MFA) is required to log in to your Principal account" (Principal). You meet that rule with a passkey or with a verification code, sent by text or phone call or made by an authenticator app. This guide covers the authenticator app, using Authenticator App - Novaz on iPhone. Any authenticator app works the same way.
How we checked this guide: the Principal steps come from Principal's own help pages, linked below, which we read on October 20, 2026. We haven't tested them on a Principal account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Passkey or codes
When you first set up online access, Principal has you set up a passkey or multi-factor authentication. The first time you log in, you choose how codes reach you: a text, a call, or an authenticator app (Principal). If you picked text or calls back then, you can connect an app later from your profile.
Principal's customer protection guarantee page lists an authenticator app and a passkey among the security habits it recommends (Principal). See authenticator app vs. SMS for why an app beats text codes.
Connect an authenticator app
Principal's help gives these steps (Principal):
- Log in to your Principal account on principal.com.
- Go to My Profile, then click Manage 2-Factor Authentication Preferences.
- Click the blue Connect Authenticator button next to Authenticator app.
- Principal shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on your iPhone's own screen, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- If you can't scan it, use what Principal calls the 16-digit code. That's the setup key. In Novaz, tap +, then Enter key manually, type Principal as the Service, and type the code as the Setup key. See What is a 2FA setup key?
- On the Principal site, click Next or Continue (the help names both).
- Type the 6-digit code from Novaz.
Principal says its codes have 6 digits and change every 30 seconds. That matches what Novaz makes from a typed key, so scanning and typing both fit. Principal also says its site is optimized for Google Authenticator, without naming other apps.
Other answers on the same page spell the labels differently, such as My profile and Manage two-factor authentication preferences, so expect small differences.
When Principal asks for a code
Without a passkey, Principal asks for a code every time you log in, and when you reset a forgotten password. In the reset flow, the code can come by text, voice call or authenticator app (Principal).
A passkey replaces the code with your face, fingerprint or PIN. Principal saves it to your device's password manager, such as Apple Passwords, not to an authenticator app. See Apple Passwords vs. an authenticator app.
No backup codes
Principal's help doesn't mention backup or recovery codes. Without a Novaz backup, its keys exist only on your iPhone, so plan another way in now. Keep your mobile number current: you can update it, with your MFA settings, under My profile while you're logged in. Principal's customer protection guarantee asks for that too (Principal). A passkey gives you a second way to log in. Principal doesn't say whether text or call codes stay available once an app is connected.
If Principal rejects your code
Principal's troubleshooting only covers text and voice codes that don't arrive. For a refused authenticator code, check the iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. With several accounts in Novaz, make sure you're reading the Principal one. More causes in Authenticator code not working?
Changing phones
Principal's help doesn't describe moving the authenticator to a new phone, and its MFA settings are only reachable once you're logged in. So switch while the old iPhone still makes codes: log in with it, then look in Manage 2-Factor Authentication Preferences for a way to connect the app again. If you have a Novaz iCloud backup or backup file, you can restore it on the new iPhone instead; without one, the new phone needs Principal added from scratch. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
If you have a passkey, or codes by text or call still work, log in that way and connect the app again. Otherwise, Principal's documented route is the phone: call +1-800-986-3343, Monday to Friday, 7 a.m. to 7 p.m. Central time, and ask for login assistance (Principal).
Principal's help names two identity checks. You answer three security questions at setup, and Principal says it uses them whenever it needs to verify you. It can also ask for a government-issued photo ID and a selfie, a document check it mentions for people locked out by an old phone number or email. It doesn't say what the phone team asks for or how long a reset takes. See Lost the phone with your authenticator app?
