University of Oxford MFA: how to set up an authenticator app

Your Oxford Single Sign-On (SSO) account, abcd1234@ox.ac.uk, signs you in to Nexus365 email, OxIntranet and most University sites, and MFA (multi-factor authentication) is required on every one (Oxford). Setup suggests Microsoft Authenticator, but IT Services also lists an Alternative authenticator, such as Authy or Google Authenticator (Oxford).

Phone methods are on their way out. New University members can't choose a call or text, and both stop working on February 1, 2027 (Oxford). Other options are Microsoft Authenticator, Zoho OneAuth and a FIDO2 security key. This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the University of Oxford steps come from Oxford's own IT pages, linked below. The central IT Services pages blocked our automated reader, and the old IT Help site closed on June 24, 2026 (Oxford), so on October 19, 2026 we read archived copies on web.archive.org, saved between May and September 2026. We read the Mathematical Institute's IT page directly (updated October 13, 2026). We haven't tested the steps on an Oxford account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Add an authenticator app in My Sign-Ins

Use a computer if you can, so the QR code isn't on your phone. These labels come from the Mathematical Institute's page, the newest we found (Oxford):

1. Sign in at mysignins.microsoft.com/security-info with your SSO username. New accounts start setup at first sign-in.
2. Click Add sign-in method and choose Microsoft Authenticator.
3. Click Set up a different authentication app, then Next. A QR code appears.
4. In Novaz, tap +, then Scan QR code. If the code is on your iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
5. If you can't scan it, click Can't scan the QR code?, then Copy key. In Novaz, tap +, then Enter key manually, and type it as the Setup key. See What is a 2FA setup key?
6. Click Next, type the 6-digit code from Novaz, and click Next again.

IT Services' older page calls these buttons I want to use a different authenticator app and Can't scan image, and says to pick 6 digits if your app asks (Oxford). Oxford doesn't say how often codes change, so scan the QR code if you can: it carries the settings into Novaz.

A second method instead of backup codes

Oxford's pages don't mention backup codes; IT Services wants more than one method instead (Oxford). Novaz keys stay on your iPhone unless you back them up, so pick a second method that isn't on it: a security key, or an authenticator on a tablet or computer (OneAuth runs on Windows and macOS). Don't count on texts after January 2027.

For travel, Oxford asks for a method that works without internet or signal (Oxford); Novaz codes do.

When Oxford asks for a code

You're asked when you sign in to a service with SSO and when your session expires: after 7 days for Microsoft 365 in a browser (8 hours for Outlook on the web), 11 hours for Shibboleth sites such as CoSy, and about 90 days in desktop and mobile apps (Oxford).

Oxford always asks for your most secure method first: a security key, then a Microsoft Authenticator prompt, then an app code, then a text or call. Your chosen default only applies between equally secure methods (Oxford). If you also have Microsoft Authenticator, select I can't use my Microsoft Authenticator app right now > Use a verification code to type a code instead (Oxford).

If Oxford rejects your code

IT Services says codes come out wrong when your device's time, date or time zone is off (Oxford). On iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off.

Too many failed tries lock the account for 10 minutes; if it still fails after 30, contact the Central IT Service Desk (Oxford). More causes are in Authenticator code not working?

Moving to a new iPhone

If you have a Novaz iCloud backup or backup file, restore it on the new iPhone and your Oxford entry keeps working. Without one, while the old phone works, add Novaz on the new one as a new method in My Sign-Ins, test it, then select Delete next to the old entry (Oxford). If the old phone is gone and you have no other method, your local IT team must reset your MFA (Oxford). See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

If another method works, sign in to My Sign-Ins with it, remove the lost phone's methods, use Sign out everywhere, and add Novaz again (Oxford).

With no working method, ask your college or department's local IT team, which handles MFA resets. If you can't reach them, call the Central IT Service Desk on +44 1865 612345 with your University Card to hand (Oxford). Expect an ID check: at the Mathematical Institute, staff show official ID, and the reset removes all your methods (Oxford). Oxford doesn't say how long a reset takes. More in Lost the phone with your authenticator app?

Can you turn MFA off?

No. Exemptions are only for exceptional circumstances and need approval from someone such as your manager or tutor (Oxford).

Official University of Oxford help

• Multi-factor authentication (MFA)
• Get IT support
• How to use multi-factor authentication (MFA) (old IT Help site, archived June 2026)
• MFA troubleshooting (old IT Help site, archived May 2026)
• Your Oxford SSO Account (Mathematical Institute)
• The IT Help website has moved (archived June 2026)