Moving Microsoft Authenticator to a new iPhone or Android phone
Your work account appears after restoring the app, but sign-in approval still goes to the old phone. What needs finishing before you trade that phone in?
After you restore Microsoft Authenticator, your work account may appear on the new phone while sign-in requests still go to the old one. The backup brings back the account name, but you must register the new phone before it can approve a work sign-in. Keep the old phone available to confirm your identity while you add the new device, then test a sign-in before erasing the old one.
This distinction matters even when the old phone still works. In a recent Office365 discussion, a buyer preparing to switch iPhones could not find the old in-app iCloud backup option. Microsoft's current iPhone instructions use iCloud settings. The steps below reflect documentation checked on October 27, 2026.
Keep a working sign-in method while you move
Before trading in or erasing the old phone, list the accounts in Authenticator and identify which ones are needed for work. Keep the old app available while you register the replacement. Opening your organization's Security info page can itself require verification; the old device can approve that request while you add the new one.
Microsoft describes different restoration results for the entries in that list:
| Entry | What a supported backup restores |
|---|---|
| Personal Microsoft account with a rotating one-time code | The code |
| Personal Microsoft account using passwordless sign-in | The account name; sign-in setup must be completed again |
| Work or school account | The name; registration is required on the new phone |
| Third-party account with a supported rotating code | The code |
For example, a restored personal code and a work entry marked “Action required” can coexist. Treat the work entry as a registration task rather than deleting the entire list. If you use several organizations, complete their setup separately and record which sign-ins you have tested.
On iPhone, enable iCloud syncing and backup for Authenticator
Microsoft's current backup instructions require iCloud Drive, iCloud Keychain and iCloud Backup, with Authenticator enabled for iCloud. Check these on the old iPhone before moving:
- Open Settings → your name → iCloud → Drive and enable Sync this iPhone. Apple's Drive instructions show this setting.
- Under iCloud, open Passwords and turn on device syncing. On iOS 17 or earlier, the label is Passwords and Keychain. Keychain setup also requires two-factor authentication for your Apple Account.
- Use See All beside Saved to iCloud, find Authenticator and enable it. This is the app-level iCloud setting.
- Enable iCloud Backup and run Back Up Now. Stay on Wi-Fi and check the last-backup time shown below that button, as described in Apple's backup steps.
On the new iPhone, use the same iCloud account, enable the required settings, install Authenticator and open it. Complete sign-in for entries asking you to restore their setup. Work accounts still need the registration process below.
If the iPhone backup is missing, Microsoft says to update Authenticator on the old phone to version 6.8.33 or later and open it at least once before switching. Its troubleshooting instructions then call for reinstalling the app on the new phone. If you have already registered accounts only on the new device, make sure you can sign in to those accounts another way before removing the app. Otherwise, reinstalling it to restore the older backup could leave you unable to sign in to accounts you just set up.
On Android, choose recovery before adding accounts
As of October 2026, enable Cloud Backup in Authenticator's settings on the old Android phone and select a personal Microsoft account to hold it. Note that address. It is the recovery account, which may be different from the work addresses displayed inside the app.
On the new Android phone, choose Restore from backup or Begin recovery before signing in normally. Use the personal Microsoft account chosen for the backup. The restoration instructions then direct you to register work and school accounts again.
If the recovery option is missing because you have already added accounts, Microsoft says to sign out first. In Authenticator, this requires removing all accounts from the app. Verify another way into each account before using its settings gear and Remove account, following the removal instructions. That device can no longer verify a removed entry's sign-ins. If any entry is your only way in, preserve it rather than clearing the app just to reveal recovery.
Microsoft plans to switch Android backup to Google One in January 2027. The personal Microsoft account flow remains the documented procedure in October 2026.
An iPhone backup cannot be restored on Android, and an Android backup cannot be restored on iPhone. While the old phone works, sign in to each service and use its security settings to register the new authenticator. For a work account, use the next section. For another service, follow that service's authenticator-change process and test the new code before retiring the old device.
Register the new phone with your organization
Use a computer for the registration page so the new phone can scan its QR code. Authenticate to the website with the old phone or another method you have already registered. Do not remove that working method to make room for the replacement.
- Open Security info and sign in to the relevant work or school account.
- Select Add sign-in method, choose Microsoft Authenticator, then Add. Continue through the app-installation prompt to the QR code.
- On the new phone, use the plus button to add a Work or school account, then select Scan a QR Code.
- Scan the computer's code, continue on the website and approve its test notification on the new phone. Finish the confirmation on the computer.
The account-addition documentation covers registration, and the Security info setup guide covers the test notification. If the camera cannot scan, use the cannot-scan option on the website and manual entry in the app.
Scan the code with the new phone. With both devices on the desk, it is easy to register the old one again without setting up the replacement. Also check that the website shows the work or school account you intend to register, especially if a personal Microsoft account uses a similar address.
Your organization controls available methods. If the expected option is absent, contact IT about that account's registration policy. Adding a work account by typing credentials directly in the app is another supported route, but it has administrator-controlled requirements; it is not a universal replacement for the browser setup.
If the old phone is gone, recover access before registration
Try the sign-in screen's alternative-method option for a method you previously registered and your organization permits. A working security key or permitted text-message method can let you reach Security info and register the replacement phone. A contact email address is not automatically an MFA method: Microsoft's method table lists email and security questions for password reset, not two-factor sign-in verification.
If nothing usable remains, Microsoft directs users who replaced or lost a phone to their IT administrator. Give the help desk the affected account, what happened to the old device and whether any other method works. Being able to read mail in an existing session does not establish that you can pass fresh verification to change security settings.
An administrator can manage verification methods or require MFA re-registration. Requiring re-registration removes several existing methods, including phone numbers and Authenticator registrations. Ask IT how you will verify your identity when registering again, since the phone method you planned to use may also be removed.
Where organizational policy allows it, an authorized administrator can issue a Temporary Access Pass. This time-limited code can provide access to Security info so you can enroll a new method. Follow the validity period you are given; a TAP is not your permanent replacement password.
Personal Microsoft accounts use a different recovery system. Do not apply the company's administrator process to them. Microsoft's account-recovery guidance says support cannot help bypass two-step verification when none of the alternative verification methods is accessible. A recovery form is not a guaranteed way around that requirement.
Test each account, then retire the old registration
Leave your existing work session open and attempt a fresh sign-in in a private browsing window, using the new phone for verification. Refreshing an already-open mailbox does not test whether the new phone can approve a sign-in. If organizational policy does not prompt for verification on that sign-in, also confirm that you approved the registration test on the new device.
Test the personal and third-party codes separately. Approving a work sign-in does not show whether codes for other services work. Keep a short list of tested accounts beside the original list, and complete setup for any untested services rather than registering working accounts again.
Once the new method works, remove the old Authenticator registration from the work account's Security info. If you cannot distinguish the entries, have IT help identify the old one instead of deleting both. Confirm another permitted method remains available, then clear the old phone as part of your normal trade-in or disposal process.