Sophos Home 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Sophos Home is Sophos's antivirus for Windows PCs and Macs at home. Your Sophos Home account opens the web dashboard at my.sophos.com, where you manage your protected computers and their settings (Sophos Home).
Sophos calls two-factor authentication (2FA) multi-factor authentication, or MFA. It's optional, and sign-in codes come only from an authenticator app. The email address or phone number you add during setup is only for recovery, and using it switches MFA off (Sophos Home). Sophos marks its setup article as applying to Sophos Home Premium; a 30-day trial includes every Premium feature (Sophos Home, Sophos Home).
Sophos's setup screen suggests Microsoft Authenticator or Google Authenticator. This guide uses Authenticator App - Novaz on iPhone instead; any authenticator app works the same way.
How we checked this guide: the Sophos Home steps come from Sophos Home's own help center, including the screenshots in its articles, linked below, which we read on October 20, 2026. We haven't tested them on a Sophos Home account, and Sophos's screenshots and text don't always agree, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
No backup codes: plan your way back in
Sophos Home has no recovery codes. Two things replace them:
- A recovery email or phone number. Setup can't finish without one. A recovery email has to be different from the address you sign in with (Sophos Home).
- Direct Access on a computer. Sophos recommends it right after turning MFA on. It lets the Sophos Home program on a protected computer open your dashboard without the code (Sophos Home). Click the Sophos Home shield, then Dashboard on Windows (and your Windows password) or … > Manage Devices on a Mac. Sign in, then check Allow the current user on this computer to access your dashboard without signing in.
Anyone using that computer account can do the same, so allow it only on computers you control.
Turn on 2FA with an authenticator app
From Sophos's setup article and its screenshots (Sophos Home):
- Sign in to your Sophos Home Dashboard at my.sophos.com.
- Click your email address in the top-right corner, choose My Account, enter your password and click Unlock.
- Under Multi-Factor Authentication, click the Enable Multi-Factor Authentication slider.
- In the Authenticator app window, click Continue.
- On Set up your authenticator app, a QR code appears. In Novaz, tap +, then Scan QR code. If the code is on the same iPhone, take a screenshot and use Choose a photo (how).
- If you can't scan it, choose Can't scan the code? and copy the key. In Novaz, tap +, then Enter key manually, and paste it as the Setup key (what's a setup key?).
- Type the code from Novaz and click Continue.
- On Add a recovery email, enter a second address, or choose Use phone number as recovery. Click Send Verification, then enter the code Sophos sends. MFA is now on, and Sophos emails you to confirm.
Sophos doesn't publish its code settings, so scan the QR code if you can. A typed key always gets 6-digit, 30-second codes in Novaz.
Add the other recovery contact later: the screenshots show Recovery Email and Recovery Phone under Multi-Factor Authentication, though the text mentions a Security page.
When Sophos Home asks for a code
After your password at my.sophos.com, the Enter verification code screen asks for the code from your app; click Sign In (Sophos Home).
- Don't ask again on this device for 30 days skips the code in that browser for a month. Don't use it on shared computers.
- Forget All Devices, in the MFA section, cancels every remembered browser.
- Direct Access skips the code.
If Sophos Home rejects your code
Don't keep guessing. Sophos warns you at three attempts left, then shows Account is locked, and its Support team "is unable to remove the lock" (Sophos Home).
Sophos suggests checking that you're reading the right entry in your app and that the code hasn't expired. In Novaz, wait for a fresh code. Then check the iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when it's 15 seconds or more off. Sophos also suggests trying another browser. More causes: Authenticator code not working?
If you're locked out, use a recovery route below. If the lock wasn't caused by you, Sophos says to change your password first.
If you lose your authenticator
Sophos documents two routes, and both turn MFA off (Sophos Home):
- Direct Access. Open the dashboard from the Sophos Home program on that computer, then switch MFA off in My Account (below).
- Recovery email or phone. Sign in at my.sophos.com. On the code screen, click Need help getting a verification code?, pick your recovery contact, click Send, and enter the code. The dashboard then says MFA is disabled, with an Enable button.
Sophos's help doesn't describe a support-led reset, proof or timescale. Live chat and email support are for Premium customers, on weekdays only (Sophos Home). See also Lost the phone with your authenticator app?
Changing phones or turning MFA off
To turn MFA off, click your email address, then My Account, enter your password, click Unlock, and switch off Enable Multi-Factor Authentication (Sophos Home).
Sophos doesn't describe moving to a new phone. With the documented switch, turn MFA off while you can still sign in, then on again, scanning the new QR code with the new phone. With Novaz's iCloud backup or a backup file, you can restore your accounts on the new iPhone instead. See How to transfer your authenticator app to a new iPhone.
