University of Melbourne MFA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Every University of Melbourne student and staff member has to use multifactor authentication (MFA), and it covers all University systems (UniMelb, UniMelb). The University runs it through Okta, and its main method is Okta's own app, Okta Verify, with push prompts.
An authenticator app is allowed, but as a backup. The University lists it as Google Authenticator and only offers it once Okta Verify is set up. To use an authenticator app as your main method instead, you contact 13MELB (students) or the Service Centre (staff) (UniMelb). This guide uses Authenticator App - Novaz on iPhone for that option. Any authenticator app works the same way.
How we checked this guide: the University of Melbourne steps come from the University's own cybersecurity and Student IT pages and a PDF guide, linked below. Its sites turned away our automated reader, so on October 20, 2026 we read them as archived copies on web.archive.org, saved between December 2025 and July 2026. In October 2026 the University was also promoting FastPass, a quicker way to sign in, so some screens may have changed. We haven't tested the steps on a University account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Okta Verify comes first
The Google Authenticator option appears only after you've enrolled with Okta Verify (UniMelb), which can be on just one device (UniMelb). So the order is: install Okta Verify, enroll it at sso.unimelb.edu.au, then add Novaz. The University also asks you to set your phone's date and time to update automatically before you start (UniMelb).
Add Novaz as your Google Authenticator method
These steps follow the University's setup page (UniMelb). Use a computer, so the QR code isn't on your iPhone.
- Go to sso.unimelb.edu.au and sign in with your University username and password, confirming with Okta Verify if asked.
- On your MFA self-service dashboard, click your name in the top-right corner and choose Settings.
- Under Security Methods, click Set up next to Google Authenticator, then Setup.
- If the page asks for your type of phone, pick the Apple one. Only the University's older PDF shows this step.
- In Novaz, tap +, then Scan QR code, and point the camera at the QR code. If it's on your iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
- Type the six-digit code from Novaz into the page and click Verify.
A confirmation email follows. The older PDF calls the section Extra Verification instead of Security Methods (UniMelb), so labels may differ.
The University's steps don't mention a text key. If the page offers one because you can't scan, tap +, then Enter key manually in Novaz, and paste it as the Setup key. See What is a 2FA setup key?
Signing in with a code
After your password, select Google Authenticator and type the code from Novaz into Enter Code (UniMelb). Student IT says you're asked in a new browser or app session, on a computer you haven't used before, and when you sign in from a different country than last time. Students can be asked on campus as well (UniMelb), and prompts come more often from overseas (UniMelb).
Codes work offline. Without data abroad you can't get a push, so the University suggests adding Google Authenticator before you leave Australia (UniMelb).
If your code is rejected
Student IT names the usual cause: the phone's time and date don't match where you are (UniMelb). On iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More in Authenticator code not working?
No backup codes
The University doesn't mention backup or recovery codes. Your two methods back each other up: if Okta Verify is deleted, you can sign in with your Google Authenticator code and reset it (UniMelb).
That fails if both live on one iPhone and you lose it. Student IT points out that Google Authenticator can go on several devices (UniMelb), but Novaz keeps its keys only on your iPhone unless you back them up with iCloud backup or a backup file (Settings › Backup).
Changing phones
Do it while you still have the old phone. Sign in at sso.unimelb.edu.au, approve on the old phone, open Settings, and under Security Methods choose Remove for the old device (UniMelb). Do the same for Google Authenticator, then click Set up to add each method on the new phone. An email confirms each reset (UniMelb). With a Novaz iCloud backup or backup file, you can restore the Novaz entry on the new iPhone instead of resetting Google Authenticator. See How to transfer your authenticator app to a new iPhone.
If you lose your phone
With no working method left, the University resets your MFA for you (UniMelb):
- Students: call 13MELB (13 6352 in Australia, +61 3 9035 5511 from overseas), choose option 1 and enter your Student ID number to reach Student IT. Phones are answered Monday to Friday. On weekends, or if you can't call, use Student IT's live chat and say so.
- Staff: call the Service Centre on +61 3 8344 0888 (UniMelb).
After the reset, you get an email and enroll again at sso.unimelb.edu.au. 13MELB can also grant a temporary exclusion from MFA while you can't reach your enrolled device (UniMelb). The University doesn't say what proof it needs beyond your Student ID, or how long a reset takes. See Lost the phone with your authenticator app?
Turning it off
MFA is required, so you can't turn it off. You can drop the Google Authenticator method with Remove next to it in your settings (UniMelb), then open the entry in Novaz and tap Remove account.
