Skip to content
Novaz AuthenticatorGET

Sophos Fusion (Sophos Central) 2FA: how to set up an authenticator app

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Two methods, not one
  2. Turn on 2FA with an authenticator app
  3. When Sophos asks for a code
  4. If Sophos Fusion rejects your code
  5. Changing phones
  6. If you lose your authenticator
  7. Can you turn it off?
  8. Official Sophos help

Sophos Central, the cloud console where administrators manage their Sophos products, is being renamed Sophos Fusion. It's the same console with a new name, which Sophos says will reach consoles gradually, so you may see either one (Sophos, Sophos).

For administrators, multi-factor authentication (MFA) isn't optional. With an email address and password, Sophos requires a code from an authenticator app; text-message and email-plus-PIN codes are retired for new users, and the only other method is a passkey (Sophos). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the Sophos Fusion steps come from Sophos's own help pages and product pages, linked below, including the screenshots in its help, which we read on October 20, 2026. We haven't tested them on a Sophos account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Two methods, not one

Every administrator must register at least two MFA methods, and either one works at sign-in. Sophos suggests pairs such as a passkey plus an authenticator app, or two passkeys on different devices (Sophos).

Without a Novaz backup, its keys exist only on your iPhone, so adding it twice on that phone meets the rule but protects nothing if the phone goes missing. Make the second method something that doesn't live only on that iPhone, such as a passkey in Windows Hello or on a YubiKey; both are on Sophos's list of supported passkey options (Sophos).

Turn on 2FA with an authenticator app

New administrators: after you activate your account from the welcome email, Sophos asks you to set up MFA the second time you sign in. Under Set up MFA method, choose Authentication App, click Set up now, and continue from step 5 below (Sophos).

Adding Novaz to an account you already use (Sophos):

  1. Sign in, click your profile icon, go to My info, and click Manage MFA. (Sophos ID has the same link under My Profile.)
  2. Confirm it's you with a method you've already registered.
  3. On the Multi-factor Authentication screen, click the + icon on the right.
  4. Under Set up MFA method, select Authentication App and click Set up now.
  5. The Verify Your Device screen shows a QR code. In Novaz, tap +, then Scan QR code. If the console is open on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
  6. Type the Novaz code in Security Code. The optional Device Name helps you tell entries apart later. Click Continue.
  7. When Successful enrollment appears, click Continue.

Sophos's help and screenshots show only a QR code, with no text key, and don't give the code length or interval. Scanning covers that, since the QR code carries those settings to Novaz. You can register up to 10 authenticator apps.

When Sophos asks for a code

At every sign-in (Sophos). After your email address and password, the MFA Validation Required screen asks for the code. If you also have a passkey, Sophos offers that first; to use Novaz, click Try Another Way, enter your password, and pick the app (Sophos).

If a Super Admin turns on Require re-authentication before executing high risk operations, you also verify again before each Live Response session, and before a Response Action unless you did so in the last 15 minutes (Sophos).

If Sophos Fusion rejects your code

Go easy on retries: five wrong sign-in attempts in a row lock the account for a minute, and more failures stretch that up to five hours. Sophos Support can unlock it (Sophos).

Before trying again, check your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?

Changing phones

Do this while the old iPhone still works. Sophos won't let you go below two methods, so add the new one first (Sophos):

  1. In Manage MFA, add the new iPhone with the steps above.
  2. Click the three dots next to the old entry, then Delete.

Tapping Remove account in Novaz on the old phone doesn't remove anything on Sophos's side: the method stays registered until you delete it there (Sophos). If you use Novaz's iCloud backup or a backup file, you can instead restore your accounts on the new iPhone, and the existing entry keeps working. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Sophos's help doesn't mention backup or recovery codes. Your second method is the backup:

  • Your other method still works: sign in with it, add Novaz on the new phone, and delete the lost entry.
  • Neither method works: ask a Super Admin on your account, or your Partner Super Admin if a Sophos partner manages it, to reset your MFA (Sophos). They open My Environment > Users & Groups, select you on the Users tab, and click Reset MFA, then Reset. Sophos emails you a security code for your next sign-in, and you set up your methods again (Sophos).
  • No other Super Admin: Sophos says to contact Sophos Support with a customer care case (Sophos). Its help doesn't say what proof Support asks for or how long a reset takes.

More in Lost the phone with your authenticator app?

Can you turn it off?

Not for an email-and-password admin sign-in: Sophos requires an app or passkey and keeps you at two methods or more (Sophos, Sophos). With federated sign-in, for example through Microsoft Entra ID, MFA can come from that identity provider instead (Sophos, Sophos).

Official Sophos help

More guides: Security, identity and VPN