UniFi 2FA: how to set up an authenticator app for your UI Account
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Your UI Account is the Ubiquiti sign-in for UniFi Site Manager, which reaches your consoles when Remote Management is on (Ubiquiti). Multi-factor authentication (MFA) on that account isn't a choice. Ubiquiti has required it for every UI Account since July 22, 2024, and accounts that hadn't picked a method got email codes switched on for them (Ubiquiti).
The choice is which methods to use: Ubiquiti's own UI Verify app with one-tap prompts, email codes, backup recovery codes, or a third-party authenticator app such as Google Authenticator (Ubiquiti). Its compliance page also lists hardware tokens (Ubiquiti). This guide uses Authenticator App - Novaz on iPhone, and other authenticator apps follow the same steps.
One fact shapes the rest. Ubiquiti says "we cannot reset your multi-factor authentication" (Ubiquiti). If you lose every method, there's no support route back in.
How we checked this guide: the UniFi steps come from Ubiquiti's own help center articles, linked below, which we read on October 20, 2026. We haven't tested them on a UI Account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
Ubiquiti's help article gives only an outline (Ubiquiti):
- Sign in to your UI Account at account.ui.com.
- Go to the Security section.
- Add a new MFA method, and pick the authenticator app option rather than UI Verify or email.
The article stops there. It doesn't say whether you'll get a QR code, a text key or both, or give the code length and interval. In Novaz:
- If you see a QR code, open Novaz, tap +, then Scan QR code, and aim the camera at it. If the QR code is on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- If you're given a text key, tap +, then Enter key manually. Put UniFi in Service, your email in Account if you want it, and the key in Setup key. See What is a 2FA setup key?
- When your UI Account asks you to confirm the new method, type the code Novaz is showing.
Scan the QR code if both are offered. It carries the code settings with it, while a typed key always gives 6 digits every 30 seconds in Novaz, and Ubiquiti doesn't publish its settings. To check, tap the UniFi entry and look at Interval under Details.
Keep a second method
Ubiquiti points out that authenticator apps and UI Verify are each tied to one phone, and recommends having more than one method on the account for that reason (Ubiquiti). That's sound advice with Novaz too. Its keys stay on your iPhone unless you turn on iCloud backup or export a backup file, and even then a second method is your way in if the backup is out of date.
- Email authentication. Ubiquiti says it can use the same address as your UI Account (Ubiquiti).
- Backup recovery codes. The help page says Ubiquiti offers them, but not where to make them or how many you get. If you find them in the Security section, print them or put them in a password manager, anywhere but the phone itself. See 2FA backup codes.
When UniFi asks for a code
Ubiquiti's FAQ says MFA applies to everyone signing in to a UniFi device. The one exception is signing in to a device on your local network with local credentials (Ubiquiti). Local-only setups use their own username, admin by default (Ubiquiti). The help pages don't say whether UniFi remembers a trusted browser or how often it asks.
If UniFi rejects your code
Nothing in Ubiquiti's help center covers a code that won't work. A drifting phone clock is the likeliest culprit. On iPhone, go to Settings > General > Date & Time and turn on Set Automatically. Novaz shows a warning once the clock is off by 15 seconds or more. For other causes, see Authenticator code not working?
Changing phones
Ubiquiti doesn't document moving an authenticator app to a new phone. In Novaz, restore your accounts on the new iPhone from iCloud backup or a backup file and the UniFi codes carry over. Without a backup, you'll set UniFi up again on the new iPhone. Keep your email method or recovery codes working during the switch, and don't wipe the old phone until the new one has signed you in. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Sign in with another method, such as an email code, a recovery code or UI Verify. Then set up the authenticator again under Security.
If every method is gone, Ubiquiti's answer is to create a new account. It won't reset MFA for you, and its help page describes no identity check or support request that gets you back in (Ubiquiti).
A new account doesn't bring your hardware with it. According to Ubiquiti's ownership article, only the owner account can hand over a UniFi OS console, using Transfer Ownership in the console's Control Plane. If the owner can't get back into their credentials, the article says the deployment can't be recovered, and every device needs a factory reset and a fresh setup (Ubiquiti). More in Lost the phone with your authenticator app?
Turning 2FA off
You can't run a UI Account without MFA, since Ubiquiti requires it for all users (Ubiquiti). Removing one method while keeping others isn't covered.
