Security · Fix-itDraft

Got a new phone? Move your Microsoft Authenticator first

Draft. Not published yet.

A new phone is one of the easiest ways to get locked out of email, Teams, and banking. Microsoft Authenticator holds the approvals and codes that prove it’s you. Move that app before you wipe, trade in, or recycle the old phone.

Microsoft’s own guidance is to keep the old phone until you can sign in to the accounts you use most from the new one. Don’t skip that.

This walkthrough covers a planned transfer, then what to do if the old phone is already gone.

Before you start

  • You need the old phone, still able to open Authenticator, unless you’re in the “old phone is gone” section below.
  • Backups don’t cross platforms. An iPhone backup cannot be restored on Android, and an Android backup cannot be restored on iPhone.
  • For work or school accounts, a backup usually restores only the account name. You’ll sign in again on the new phone to finish setup. You may see red text that says Sign in to add your account. That’s expected.
  • Personal Microsoft accounts that use a rotating 30-second code usually restore the code. If the account also uses passwordless sign-in, you may only get the account name back and have to sign in again.
  • Third-party accounts (such as Google, Facebook, or Amazon) that use a 30-second code usually restore that code.
  • Passkeys are separate from Authenticator’s account backup. If a passkey lived only on the old phone, add a new passkey on the new phone before you remove the old one.

1. Turn on backup on the old phone

iPhone

Microsoft currently backs up Authenticator through iCloud, not through a personal Microsoft account.

  1. On the old iPhone, turn on iCloud Drive, iCloud Keychain, and iCloud Backup.
  2. Go to Apple Account > iCloud > Saved to iCloud (wording can vary slightly by iOS version).
  3. Find Authenticator and turn it on.
  4. Open the Authenticator app at least once so the backup can run. Use a current version of the app.

Android

  1. Open Microsoft Authenticator.
  2. Open the menu and go to Settings.
  3. Turn on Cloud Backup.
  4. Choose a personal Microsoft account to store the backup, then tap OK. Remember which account you used. You’ll need it on the new phone.

Microsoft’s support page notes a change coming in January 2027: Android backups will move to Google One instead of a personal Microsoft account. If you’re setting this up after that change, follow the in-app instructions for Google One backup.

If you backed up to the wrong account, turn Cloud Backup off to delete the backup, then turn it on again and choose the right account.

2. Restore Authenticator on the new phone

  1. Install Microsoft Authenticator from the App Store or Google Play.
  2. Open the app. Before you start adding accounts by hand, look for Begin Recovery or Restore from backup. The label can vary by app version. Use that first. Adding accounts manually beforehand can conflict with the restored ones.
  3. Sign in with the same personal Microsoft account you used for the Android backup, or make sure the new iPhone is signed in to the same Apple ID with Authenticator enabled in iCloud.
  4. Wait for the accounts to appear.

If restore isn’t offered, confirm that backup was on, you’re using the same recovery account, and you’re staying on the same platform (iPhone to iPhone, or Android to Android). On a new iPhone, Microsoft’s troubleshooting steps include uninstalling and reinstalling Authenticator after iCloud is set up.

3. Finish each account, starting with work and school

Open every work or school account in the app and sign in when asked. Have another sign-in method ready if you need it, such as a code from the old phone, a passkey, or a backup method already on the account.

For a work or school account, you can also add the new method from https://aka.ms/mysecurityinfo (Add sign-in method) while you still have the old phone. If your admin doesn’t allow self-service setup, use their process.

Test sign-in to Microsoft 365, Teams, and any other app you rely on. Only after those work should you remove the old phone as a sign-in method or wipe it.

If the account requires a passkey in Authenticator:

  1. Sign in with the old device while you still have it.
  2. At https://aka.ms/mysecurityinfo, add a passkey for the new phone.
  3. Test it, then remove the old passkey or device.

If the passkey is stored in a synced manager such as iCloud Keychain, Google Password Manager, or Microsoft Password Manager, it may already be available. Confirm that before you drop the old phone.

If the old phone is already gone

Don’t try random recovery sites or a paid “unlock” service.

Personal Microsoft account. Try official account recovery or “Forgot my password” at the Microsoft sign-in page. Use another security method you already set up: a backup email, a phone number, a recovery code, or another device that’s still signed in. After you’re in, add Authenticator on the new phone from account.microsoft.com/security and remove the lost phone.

Work or school account. Contact your IT admin or help desk and ask them to reset your MFA registration. After they clear the old device, sign in and register Authenticator on the new phone. If you have another approved method (a FIDO2 key, a passkey, or a backup code your organization issued), use that first, then add the new phone and remove the old one.

Third-party accounts. Use each site’s official 2FA reset or backup codes. That’s why backup codes printed or saved when you first turned on 2FA matter.

If you didn’t turn on Authenticator backup before the phone was lost, the 30-second codes for those accounts can’t be pulled out of thin air. You’ll recover each account through its own official process.

What not to do

  • Don’t factory-reset or hand over the old phone until sign-in works on the new one.
  • Don’t delete the authenticator method from your Microsoft or work account until the new phone can approve a sign-in.
  • Don’t expect an iPhone backup to restore on an Android phone, or the other way around.

Still stuck?

If you’re locked out after a phone swap, I can help you work through the official recovery steps or talk with your admin about an MFA reset. Support is after-hours, nationwide, with local help in the Dallas–Fort Worth area. See the Work with me page.

Sources checked