Zimbra 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Zimbra Collaboration is email and calendar software that companies, schools and hosting providers run on their own servers. You don't sign up with Zimbra itself, so your administrator decides whether two-factor authentication (2FA) is available, whether it's required, and which methods you get. The methods are codes from an authenticator app and, since version 10.1, codes sent to a recovery email address (Zimbra). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.
How we checked this guide: the Zimbra steps come from Zimbra's own user guides, wiki and blog, linked below, which we read on October 20, 2026. We haven't tested them on a Zimbra account. Labels differ between Zimbra versions and between the Modern and Classic web apps, so what you see may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Is the option there for you?
Look in your settings for a Two-factor authentication section. If it's missing, Zimbra's blog says "your organization has not enabled the 2FA feature": ask your administrator or email provider (Zimbra). The server's license also has to include it (Zimbra).
If 2FA is mandatory, a setup page appears right after you sign in, and your mail stays locked until you finish. Select Begin setup and follow the steps below from step 5 (Zimbra).
Turn on 2FA with an authenticator app
These steps are for the Modern Web App in Zimbra 10.1 (Zimbra, Zimbra):
- Sign in to your Zimbra webmail, select the gear icon at the top right, then Settings.
- Select Accounts and choose your account.
- Scroll to Two-factor authentication. Next to Third-party authentication app, select Set up this method. Zimbra's user guide calls this button Set up two-factor authentication, so the label may differ on your server.
- Enter your Zimbra password.
- Zimbra links to a list of tested apps, but says any standard time-based code app should work (Zimbra). Select Next.
- Zimbra shows a QR code and a key. In Novaz, tap +, then Scan QR code, and point the camera at the screen. If the webmail is open on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
- To type the key instead, tap +, then Enter key manually, and put it in Setup key. See What is a 2FA setup key?
- Select Next, type the 6-digit code from Novaz, and select Verify.
Scan if you can. Zimbra's pages aren't clear on how often codes change (two mention 15 seconds in passing), and a typed key always gets 30 seconds in Novaz (Zimbra). A QR code can carry the right setting.
In the Classic Web App, older pages put it under Preferences > Accounts as Setup two-step authentication (Zimbra).
Your mail apps need app passcodes
Mail programs that connect over IMAP or ActiveSync, and most desktop email programs, can't ask for a code. If your admin allows it, make an app passcode: in the Two-factor authentication section, select Add a passcode, name it, select Next, and use it in place of your password in that program (Zimbra). Changing your Zimbra password revokes every app passcode (Zimbra).
Save your one-time codes
Zimbra gives you a set of one-time codes, usually ten (your admin sets the number). In the Two-factor authentication section, select 10 unused codes, then Copy to clipboard, and store them away from your phone. Each works once, and without them or your app you can't sign in (Zimbra). When you run out, select Generate new codes.
They're what you fall back on if the phone is lost and Novaz has no backup to restore from (iCloud backup or a backup file). See 2FA backup codes.
When Zimbra asks for a code
Zimbra asks at every sign-in. Check Always trust this device before Verify to skip the code on that device later. To undo it, select Don't trust this device in the Two-factor authentication section while signed in on it (Zimbra). Your admin may have turned this option off, as Zimbra's wiki recommends (Zimbra).
With both app and email codes set up, Zimbra asks for your preferred one. To switch at sign-in, select Use other method, which the 10.1 release notes call Use a different method (Zimbra, Zimbra).
If Zimbra rejects your code
Zimbra's pages have no advice for this. Check your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. If you typed the key and the first code fails during setup, tap the account in Novaz, tap Remove account, and scan the QR code instead. More in Authenticator code not working?
Changing phones
Zimbra doesn't document a phone switch. In 10.1, while you can still sign in, use Remove this method next to the app, then set it up again on the new phone. If 2FA is mandatory, you can't remove your last method, so add email codes first or ask your admin (Zimbra). If you've turned on iCloud backup or exported a backup file in Novaz, you can restore your accounts on the new iPhone instead and keep the same method. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
- Sign in with one of your one-time codes.
- If you set up email codes, choose that method at sign-in and get a code at your recovery address.
- Otherwise, contact whoever runs your Zimbra server. Admins can reset your 2FA methods from the admin console (Zimbra). What proof they ask for, and how long it takes, is up to them.
More in Lost the phone with your authenticator app?
Turning 2FA off
In the Two-factor authentication section, select Remove two-factor authentication, or Remove this method for one method in 10.1. You can only do this if your admin allows it (Zimbra).
