# Ensure 2FA Backup Codes Are Generated

- Source: https://support.icompaas.com/support/solutions/articles/a_1791826022061938-ensure-2fa-backup-codes-are-generated
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [OVH Cloud](https://support.icompaas.com/support/solutions/c_1791819364512367) › [checks](https://support.icompaas.com/support/solutions/folders/f_1791819376721251)
- Last updated: 2026-10-12
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that the OVHcloud account has a valid set of two-factor authentication backup codes, and that they are stored securely, for example in a password manager. Backup codes are single-use codes that let you sign in if your 2FA device is lost, stolen, or broken.

**Rationale**

If the only 2FA device is lost and no backup codes are available, the account owner can be locked out of the Control Panel, and recovery requires a slow identity check with OVHcloud support. Keeping valid backup codes makes sure the account can always be recovered quickly without weakening its security.

**Impact**

-   The account can be recovered if a 2FA device is lost
    
-   Avoids long lock-outs from the Control Panel
    
-   Backup codes must be stored securely, as each can be used to sign in
    

**Default Value**

10 single-use backup codes are shown when the first 2FA method is set up. They are not generated if 2FA is never enabled, and they run out as they are used.

**Pre-Requisites**

-   Two-factor authentication enabled on the account
    
-   A secure place to store the codes, such as a password manager
    

**Test Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  Click your name in the top-right corner to open your account menu, then go to Security (the Account security page).
    
3.  In the Two-factor authentication section, verify that backup codes are active.
    
4.  Confirm that the codes are stored in your password manager and that not all of them have been used.
    
5.  If backup codes are missing, used up, or lost, follow the implementation steps.
    

**Implementation Steps**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  Click your name in the top-right corner to open your account menu, then go to Security (the Account security page).
    
3.  In the Two-factor authentication section, find the backup codes and select the option to regenerate them.
    
4.  Copy the 10 new codes and store them in a password manager. The old codes stop working.
    

**Backout Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  Click your name in the top-right corner to open your account menu, then go to Security (the Account security page).
    
3.  In the Two-factor authentication section, regenerate the backup codes again if the new set is lost.
    

**Reference**

-   [https://help.ovhcloud.com/csm/en-account-enable-2fa?id=kb\_article\_view&sysparm\_article=KB0043079](https://help.ovhcloud.com/csm/en-account-enable-2fa?id=kb_article_view&sysparm_article=KB0043079)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.