Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/index.html?contextId=a8d6ae8e-3650-4a6e-b95a-3e9063f4ec4f

Migrate to another authenticator application

If you've configured multi-factor authentication that uses an authenticator generating passcodes, users may need to rescan the QR code later.

For example, you may want users to migrate to another authenticator app, or a user may have lost their mobile device and doesn't have a backup. For supported authenticator apps, see Third-party authenticator support.

Delete issued tokens in the firewall

You must stop allowing passcodes generated by the previous authenticator application. Do as follows on the web admin console:

  1. Go to Authentication > Multi-factor authentication.
  2. Under One-time password (OTP), make sure Generate OTP token with next sign-in is turned on.
  3. Under Issued tokens, select the users using the unsupported application and click the delete button .

Users rescan the QR code

The users whose tokens you've deleted must do as follows:

  1. Sign in to the user portal using only the password.

    They must not enter the passcode generated by the old app because it becomes invalid. The QR code appears.

  2. Scan the QR code shown using a supported authenticator app.

  3. Sign in to the user portal using the password followed by the generated passcode, for example, <password><passcode>.