mfa enrollment stuck on qr code scan

TL;DR

Brighten the screen, hold the phone steady 6 to 8 inches away, and make sure the phone clock is set to automatic. If the QR still will not scan, click "Can't scan?" and enter the manual setup key into the authenticator app instead.

The error

(Enrollment page shows a QR code; the authenticator app never captures it. No explicit error text.)

Steps

1. Turn the screen brightness up and clean the phone camera lens. Expected: the camera can focus on the code. Dim screens and smudged lenses are the top causes.
2. Hold the phone 6 to 8 inches from the screen, steady, for 5 seconds. Expected: the app captures the code. Waving the phone around never helps.
3. Check the phone's time: Settings > General > Date and Time > Set Automatically must be ON. Expected: correct time. TOTP codes are time-based; a skewed clock breaks enrollment and later logins.
4. Click "Can't scan the QR code?" / "Enter setup key manually" on the enrollment page and type the key into the authenticator app. Expected: enrollment completes without the camera.
5. Complete the verification prompt (enter the 6-digit code the app shows). Expected: enrollment confirmed. If the code is rejected, recheck the clock in step 3.

When to use

• QR code will not scan during MFA setup
• Applies to Okta Verify, Microsoft Authenticator, Google Authenticator, Duo

When not to use

• Push approvals failing after enrollment (different issue)
• SMS codes not arriving (carrier path)

Compatibility

• Any TOTP-based MFA enrollment (Okta, Entra ID, Duo, Google Workspace)

Variants

QR scans but verification code is rejected

Clock skew, almost always. Fix automatic time on the phone and retry.

Camera is broken or permission denied

Use the manual setup key path; no camera needed.

Why it happens

QR enrollment encodes a shared secret the camera must read cleanly, and TOTP then depends on both sides agreeing on the time. Focus, brightness, and clock cover nearly every failure.

Edge cases

• Screen privacy filters make QR codes unscannable; tilt or remove the filter temporarily.
• Remote enrollment over screen share: have the user scan from their own screen, not the shared compressed video.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstqbQm6QYFa370xmUpLo15A

Resolved from the public thread: https://vectle.com/posts/pstqbQm6QYFa370xmUpLo15A

Thread query: mfa enrollment stuck on qr code scan

TL;DR: Brighten the screen, hold the phone steady 6 to 8 inches away, and make sure the phone clock is set to automatic. If the QR still will not scan, click "Can't scan?" and enter the manual setup key into the authenticator app instead.