Veeam 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
With Veeam, two-factor authentication (2FA) can mean two unrelated sign-ins, and you may need both:
- Your Veeam Account, the login for the My Account portal at my.veeam.com, where support cases and license files live (Veeam). You turn 2FA on yourself. Since July 7, 2026, it's required to sign in to Veeam Data Cloud with Continue with Veeam, though not with Continue with Microsoft (Veeam).
- Your user on a Veeam Backup & Replication server your company runs. An administrator switches multi-factor authentication (MFA) on for all console and web UI users at once, and each person sets up their app at the next sign-in (Veeam).
Each needs its own entry in your authenticator app, and both use 6-digit codes. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the Veeam steps come from Veeam's own knowledge base and Help Center, including their screenshots, linked below, which we read on October 20, 2026. We haven't tested them on a Veeam Account or a Veeam server, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Veeam Account: turn on 2FA
From Veeam's knowledge base (Veeam):
- Sign in at my.veeam.com.
- Click the avatar in the top-right corner and select Edit profile.
- At the very bottom of My profile, click Enable MFA. This opens the Account Security page.
- Click Set up Authenticator application.
- Veeam shows a QR code. In Novaz, tap +, then Scan QR code. If the page is open on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
- Can't scan it? Click Enter the setup key manually instead. In Novaz, tap +, then Enter key manually, and type the key as the Setup key. Veeam doesn't say how often its codes change, so scan the QR code when you can. See What is a 2FA setup key?
- Type the code from Novaz in One-time code. Device Name is optional. Click Submit.
Add recovery codes as a separate step
The authenticator doesn't come with recovery codes. Veeam recommends adding them: on the same Account Security page, click Set up Recovery authentication codes, save the list, tick the box, and click Complete Setup. You can't see the codes again after you leave that page. There are 12 of them, and Veeam asks for a specific one by number, such as #1 or #2. After you sign in with the 12th, it shows a fresh set of 12 to save (Veeam).
Save them even if you back up Novaz: they get you in if the phone is lost and your Novaz backup is missing or out of date. Store them away from the phone. More in 2FA backup codes.
Veeam Backup & Replication: MFA for the console and web UI
A user with the Backup Administrator role turns it on in the console: Users & Roles > Security, remove any user groups from the list (MFA works only for individual user accounts), select Enable multi-factor authentication (MFA), and click OK. It isn't available in the Community Edition. Service accounts used by PowerShell, the REST API and some Veeam components can't use MFA, so the administrator marks each with This is a service account (disables two-factor authentication) (Veeam).
At your next sign-in, after your user name and password, Veeam opens Configure multi-factor authentication (MFA) (Veeam, Veeam):
- In Novaz, tap +, then Scan QR code. Or tap Enter key manually and type the key shown under Or enter the following key manually.
- Type the code from Novaz under Enter the one-time code shown in the app and click Confirm.
After that, Veeam asks for a code at every sign-in and before any change to Users & Roles settings. It doesn't document backup codes for console users.
On a Linux-based backup server, your Veeam Host Management code also signs you in to the console and web UI. Upgrading such a server to version 13.1 merged the two codes into the Host Management one (Veeam).
If Veeam rejects your code
On a Backup & Replication server, codes only work when the server and your phone agree on the time, so both must be synced to UTC (Veeam). If your phone is right, ask the administrator to check the server's clock. After more than 5 failed tries, reopen the console and wait at least a minute.
Veeam's Account guide doesn't cover rejected app codes. On your iPhone, turn on Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More in Authenticator code not working?
Changing phones or losing your authenticator
With a Novaz iCloud backup or backup file, you can restore Veeam on the new iPhone. Without one, you'll set up Veeam again on the new phone. See How to transfer your authenticator app to a new iPhone.
- Veeam Account: Veeam doesn't describe a phone switch, but while you can still sign in you can delete the authenticator and set it up again. Lost both the app and your recovery codes? Contact your Veeam sales representative (or the Contact Sales form), who verifies your identity and asks Veeam Support to turn MFA off. Veeam doesn't say what proof it needs or how long it takes (Veeam).
- Backup & Replication: a backup administrator selects your user under Users & Roles > Security and clicks Reset MFA. You set it up again at your next sign-in. If every backup administrator is locked out, Veeam says to contact Veeam Support (Veeam).
- Linux appliance: another Host Administrator uses Settings > Reset MFA on your user (Veeam). A Security Officer signs in with the saved recovery token via Forgot password? (Veeam).
More in Lost the phone with your authenticator app?
Turning 2FA off
- Veeam Account: on the Account Security page, click the red Delete in the Authenticator application section, then Confirm Deletion. Recovery codes stay active, so delete them in the Recovery authentication codes section too if you won't add another app. Remember that Veeam Data Cloud's Continue with Veeam needs MFA (Veeam).
- Backup & Replication: an administrator clears Enable multi-factor authentication (MFA) under Users & Roles > Security, for all users at once (Veeam).
