Toronto Metropolitan University 2FA: how to set up an authenticator app for your TMU account

Your Toronto Metropolitan University (TMU) account is the my.torontomu username and password you use for D2L Brightspace, Google Workspace at TMU, MyServiceHub, eHR and dozens of other campus systems. TMU signs you in to these through its own login service, CAS, which the university has extended with its own two-factor authentication (TMU). It isn't optional: since February 25, 2022, students have needed it alongside faculty and staff, and a listed system blocks you until it's set up (TMU).

You can make codes with a phone app, use a FIDO2 or U2F security key or your computer's biometrics, or, if you're an employee, a small one-time verification (OTV) code generator. There's no text-message code for everyday sign-ins. This guide uses Authenticator App - Novaz on iPhone, with one caveat explained below.

How we checked this guide: the TMU steps come from the help pages of TMU's Computing and Communications Services (CCS), linked below, which we read on October 21, 2026. We haven't tested them on a TMU account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

TMU names only Google Authenticator

TMU's setup page tells you to install Google Authenticator and doesn't mention any other app (TMU). It says the phone option needs no texts, mobile data or Wi-Fi, like standard authenticator codes. But the pages don't show the setup screen, so they don't say whether you get a QR code or a typed key, or how often codes change. Novaz handles time-based codes only.

The setup is its own test. TMU saves your phone only after you type a working code from the app, so if Novaz can't read what TMU shows, the setup simply won't finish and your account stays as it was. In that case, use Google Authenticator as TMU asks.

Your TMU Microsoft 365 account is separate. It uses Microsoft's own MFA, set up through Microsoft's sign-in pages, and TMU explains it on a different page (TMU). This guide covers the my.torontomu two-factor only.

Add your iPhone in my.torontomu

TMU's steps are for a computer, which keeps the code on a different screen from your phone (TMU):

1. On your computer, sign in to the my.torontomu portal with your username and password.
2. In the Self Service box, select Personal Account.
3. Under Security, select Two-Factor Authentication.
4. Under Mobile Devices, select Add mobile device, then choose iOS.
5. Skip the install instructions and go to the section Next, open and configure Google Authenticator. Where it tells you to use Google Authenticator, use Novaz instead: tap +, then Scan QR code, and point the camera at the screen.
6. If the page offers a key to type instead, tap +, then Enter key manually, and fill in Service and Setup key. A typed key always gives 6-digit codes every 30 seconds, so scan the QR code if there is one. See What is a 2FA setup key?
7. Type the code from Novaz on the page and select verify and save at the bottom.
8. On the backup codes page that follows, select Generate new backup codes.

Keep the backup codes on paper

Backup codes work once each, for when your phone is lost, stolen or replaced. TMU suggests printing them or writing them down and keeping them somewhere you can reach. You can make a new set any time from the same Two-Factor Authentication page with Generate new backup codes (TMU).

Keep them even with a Novaz iCloud backup or backup file: they're your spare if the phone goes and that backup is missing or out of date. Don't store them in your TMU Gmail or Drive, which sit behind the same sign-in. More in 2FA backup codes.

When TMU asks for a code

After your username and password, a two-factor screen asks for a verification code. Tick I trust this browser on this device. Don't ask for codes for 30 days. on a computer only you use. TMU remembers that choice with a cookie, so each browser and device has to be trusted separately, and private windows or cleared cookies bring the prompt back. To forget every trusted browser, select Revoke all Trusted Devices on the Two-Factor Authentication page (TMU).

If TMU rejects your code

TMU's pages give no advice for this. Check your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes in Authenticator code not working?

Moving to a new iPhone

TMU ties two-factor to the phone you set it up with, and its pages describe changing phones as revoking the old one, then adding the new one (TMU). A Novaz iCloud backup or backup file lets you restore your accounts on the new iPhone instead. Without one, set TMU up again:

1. Make sure you have unused backup codes.
2. Under Two-Factor authentication is set up for:, select Revoke next to Mobile Device. If the old phone is listed under trusted devices, select Revoke all Trusted Devices too.
3. Add the new iPhone with the steps above.

See How to transfer your authenticator app to a new iPhone.

If you lose your phone

TMU's lockout page gives three ways back in (TMU):

1. A backup code, typed where the verification code goes. TMU says you may also have received codes by email.
2. An emergency code from the CCS Help Desk: 416-979-5000, ext. 556840 for students or ext. 556806 for employees. The page doesn't say what proof the Help Desk asks for or how long it takes.
3. A one-time text message, only if you registered a mobile number for account recovery. On the login page, select I've deleted the authenticator app/lost my phone and am locked out. and enter that number. It works once per account, ever.

Once you're in, revoke the lost phone and set up the new one as above. More in Lost the phone with your authenticator app?

Removing Novaz

Revoke removes the phone from your TMU account, but so many TMU systems require two-factor that you need another method first. Then open TMU in Novaz and tap Remove account.

Official TMU help

• Two-Factor Authentication
• Setting Up Two-Factor Authentication
• How to Use Two-Factor
• Locked Out? New Phone?
• Apps That Require Two-Factor Authentication
• Central Authentication Service (CAS)
• Multi-Factor Authentication for Microsoft Office 365