How to Move Microsoft Authenticator to a New Phone (Without Getting Locked Out)

Got a new phone? Moving Microsoft Authenticator is the one step you shouldn't leave until after you've reset the old phone. If you lose the app before setting it up again, you can get locked out of your work account, your Microsoft account and every other site that uses it for two-step verification.

In IT support, it's one of the most common reasons people get locked out. Here's the safe order to do it, for both personal and work accounts, plus what to do if the old phone is already gone.

Golden rule: keep the old phone working until every account works on the new one. Don't factory reset, trade in or remove the app from the old phone first.

Step 1: Turn on backup in the old phone's Authenticator

1. Open Microsoft Authenticator on the old phone.
2. Open Settings (the menu icon at the top).
3. Turn on Cloud backup (Android) or iCloud backup (iPhone).
4. Android needs a personal Microsoft account to store the backup; iPhone uses your iCloud account (with iCloud Keychain on).
5. Wait until the app confirms the backup, then note which account you used.

Important: backups only restore to the same platform. Android to Android and iPhone to iPhone work; Android to iPhone (or the reverse) doesn't. For a platform switch, skip to Step 3 and add each account again manually.

Step 2: Restore on the new phone

1. Install Microsoft Authenticator from Google Play or the App Store. Check that the publisher is Microsoft Corporation.
2. Open it and tap Begin recovery (or "Restore from backup") instead of adding an account.
3. Sign in with the same personal Microsoft account (Android) or iCloud account (iPhone) you used for the backup.
4. Your accounts appear. Personal accounts and many third-party codes (Google, Facebook, Amazon and so on) usually work right away.

Step 3: Re-activate work or school accounts

Work and school accounts usually show "Action required" after a restore, because the secure keys for phone sign-in and push notifications don't move with the backup. To fix it, register the new phone properly while the old one still works:

1. On a computer, go to mysignins.microsoft.com/security-info (or aka.ms/mysecurityinfo) and sign in with your work account. Approve the sign-in on the old phone.
2. Click Add sign-in method, choose Microsoft Authenticator, and follow the steps to scan the QR code with the new phone.
3. Approve the test notification on the new phone.
4. Set the new phone as your default sign-in method if prompted, then delete the old phone's entry from the list.

Some organizations also require Intune Company Portal enrollment or block Authenticator on phones that aren't compliant. If the QR code step fails, contact your IT service desk.

Step 4: Test everything, then retire the old phone

• Sign out of one personal and one work service and sign in again using the new phone.
• Check that third-party codes (TOTP) match and work.
• Only then remove accounts from the old phone and reset it.

Old phone lost, broken or already reset?

Work or school account

Contact your IT service desk. After verifying your identity, an admin can require you to re-register MFA or remove the old Authenticator method in Microsoft Entra ID. You'll then register the new phone at mysignins.microsoft.com. Some companies offer a Temporary Access Pass for exactly this situation.

Personal Microsoft account

If you had cloud backup on, restore it (Step 2). If not, sign in with another verification method (alternate email, phone number or a recovery code). If you have no other method, use Microsoft's account recovery form, which can take time, so set up a second method today.

Other sites (Google, Facebook, banks and so on)

Use the backup codes you saved when you turned on two-step verification, or that site's account recovery process, then set up Authenticator again.

Common problems on a new phone

"Begin recovery" doesn't show my accounts

You're probably signed in to a different Microsoft or iCloud account than the one used for the backup, or the backup was never completed. Check the old phone's settings if you still have it.

Notifications aren't arriving

Allow notifications for Authenticator, turn off battery optimization for it (Android), and make sure the date and time are set automatically. You can also open the app and approve from inside it.

The code is rejected

One-time codes depend on the phone's clock. Turn on automatic date and time and try again.

Make the next switch painless

• Keep cloud backup turned on permanently.
• Register a second method for every important account: an alternate phone number, a security key or a passkey. Learn how passkeys work and how to set them up.
• Store backup codes in a password manager, not in your phone's gallery.
• Never approve a sign-in prompt you didn't start. Unexpected prompts mean someone has your password.

FAQ

Can I use Microsoft Authenticator on two phones?

For many personal accounts and third-party codes, yes, by adding the account on both. For work accounts, your organization decides; you can usually register more than one Authenticator device at mysignins.microsoft.com.

Does changing my SIM affect Authenticator?

No. Authenticator is tied to the app and your accounts, not the SIM. SMS codes, however, follow your phone number.

Is Microsoft Authenticator backup safe?

The backup is encrypted and protected by your Microsoft or iCloud account, so secure that account with a strong password and its own two-step verification.