SF3TECHNOLOGIES
GuidesGuides · Everyday help

Microsoft Authenticator on a new phone, without getting locked out

How to move your work sign-in to a new phone before the old one is wiped, what still works when the old phone is already gone, and exactly what to ask your IT team for.

7 minute readUpdated

The short answer

Keep the old phone until the new one signs in. Turn on Authenticator's cloud backup on the old phone, restore it on the new one, then open your work account and sign in again, because for work accounts the backup only carries the account name. If the old phone is already lost, sign in another way (a text message, a passkey or a second device) and add the app again, or ask your IT admin to reset your sign-in methods or issue a Temporary Access Pass.

Why work accounts behave differently

Personal accounts in Microsoft Authenticator, such as your bank, Amazon or a personal Gmail, store a six-digit code generator. That generator is included in the app's backup and comes back on the new phone ready to use.

Work or school accounts are different on purpose. The credential that approves your sign-in never leaves the phone it was created on. The backup restores only the account name as a placeholder, and the new phone has to sign in once to earn its own credential. Passkeys stored in the app are tied to the phone too, so they are created again on the new one. This is why people who restore a backup and see "Sign in to add your account" in red think something went wrong. Nothing did.

Before you wipe or trade in the old phone

  1. Turn on backup. iPhone: make sure iCloud Drive, iCloud Keychain and iCloud Backup are on, then go to Settings, your name, iCloud, Saved to iCloud, and turn on Authenticator. Android: open Authenticator, go to Settings and turn on Cloud Backup, choosing a personal Microsoft account to hold the backup.
  2. Add a second way to sign in. Go to aka.ms/mysecurityinfo on a computer and check what is listed. If your company allows it, add a phone number for text or call, or a passkey on a second device. A second method is what saves you if the new phone has a problem.
  3. Note the other accounts in the app. Codes for Google, Amazon, banks and similar accounts restore with the backup, but some of those services also offer backup codes. Download them now while you still can.
  4. Keep the old phone. Do not erase it until you have signed in to email from the new phone and from a computer using the new phone to approve.

Setting up the new phone

If your company manages phones with Intune, install the Company Portal app and enrol first, because some companies only allow Authenticator on an enrolled phone. Then:

  1. Restore the backup. Install Microsoft Authenticator and, on the welcome screen, choose Restore from backup (on some versions it says Begin recovery). On Android, sign in with the same personal Microsoft account you chose for the backup. On iPhone, be signed in to the same iCloud account. The restore only works from iPhone to iPhone or Android to Android.
  2. Sign in to the work account again. Tap the work account that shows "Sign in to add your account", enter your work email and password, and approve the sign-in with the old phone or another method you already have. The new phone now has its own credential.
  3. Create a passkey if your company uses them. On a computer, go to aka.ms/mysecurityinfo, choose Add sign-in method, then Passkey in Microsoft Authenticator, and follow the prompts on the new phone. Test it once.
  4. Test from a computer. Sign out of Outlook on the web and sign in again, approving with the new phone. If that works, you are done.
  5. Remove the old phone. Back in Security info, delete the old phone's Authenticator entry and any old passkey, then erase the old phone.

If the old phone is already lost, stolen or broken

You cannot restore the work credential from a backup, but you rarely need to. Try these in order:

  1. Sign in another way. When the sign-in screen asks for the app, choose "I can't use my Microsoft Authenticator app right now" or "Sign in another way". If a phone number, a passkey on another device or a security key is registered, use it. Then go to aka.ms/mysecurityinfo, add Authenticator on the new phone and remove the old one.
  2. Ask IT to reset your methods. An admin can choose "Require re-register multifactor authentication" for your account. That removes the old phone and the app, and the next time you sign in you set up Authenticator fresh with a QR code.
  3. Ask for a Temporary Access Pass. If your company has turned the feature on, an admin can issue a short-lived code that lets you sign in once and register the new phone without any old method. It is the cleanest fix for a lost phone.
  4. Report a stolen phone the same day. Ask IT to sign out all your sessions and, if the phone was managed, wipe the work data on it. Change your password at the same time.

One situation has no self-service fix: if you are the only admin of your company's Microsoft 365 and your only sign-in method was the lost phone, only Microsoft support can get you back in, through a verified request to its data protection team. It takes days. Every company should have a second admin or an emergency admin account with a passkey stored somewhere safe, and we set that up for every client.

Google Workspace accounts

Google handles a new phone more gently, with two things to know:

  • Google prompt follows your account. The "Is it you?" tap-to-approve prompt appears on any phone where you are signed in to your Google account, so a new phone works as soon as you sign in to it. Keep the old phone until that first sign-in succeeds.
  • Google Authenticator syncs if you let it. Recent versions of Google Authenticator can save your codes to your Google Account. Check that the cloud icon in the app shows sync is on before you switch phones. Without sync, use the app's Transfer accounts option, which needs both phones in hand.
  • Backup codes are your spare key. In your Google Account, go to Security, 2-Step Verification, Backup codes, and save ten single-use codes somewhere safe. If you have none and the phone is gone, your Workspace admin can generate backup codes for you from the Admin console, under the user's Security settings.
  • Passkeys are per device. As with Microsoft, a passkey created on the old phone does not move. Create one on the new phone and delete the old one.

For the person who runs IT

Most of these tickets disappear with four settings, and the rest take two minutes each:

WhatWhereWhy it matters
Require two sign-in methods at registrationMicrosoft Entra admin center, Protection, Authentication methods, registration campaign and policiesA phone number or second passkey means a lost phone is an inconvenience, not a lockout
Turn on Temporary Access PassEntra admin center, Protection, Authentication methods, Temporary Access PassLets you re-enrol a user's new phone in one step without weakening anything
Reset a user's methodsEntra admin center, Users, the user, Authentication methods, Require re-register multifactor authenticationClears the old phone so the next sign-in sets up a new one
Keep two admins and an emergency accountEntra admin center, Roles, Global Administrator; emergency account excluded from Conditional AccessThe only cure for a sole admin locked out is a support ticket measured in days
Google: backup codes for a userGoogle Admin console, Directory, Users, the user, Security, 2-Step VerificationGets a Workspace user back in without turning verification off

And one habit: remove a leaver's phone from Security info on their last day, in the same step as email and files.

FAQ

Questions people ask

Short answers to what founders and finance leads ask us most.

Ask us something else

No. For work accounts the backup carries only the account name. Tap the account, sign in with your work email and password, approve with your old phone or another method, and the new phone gets its own credential.

How SF3 Technologies helps

Phone changes, lost phones and locked-out admins are everyday help desk work for us. We set the sign-in method policies in your Microsoft 365 or Google Workspace so that a lost phone never becomes a lockout, keep an emergency admin account for your company, and walk your people through a new phone in minutes. Everything happens inside your own tenant, with dedicated admin accounts, so you stay in control.

Talk to us about help desk supportMicrosoft 365 management

Menu names in Microsoft Authenticator, Microsoft Entra and the Google Admin console change from time to time. Steps checked in October 2026 against the vendors' documentation.