Microsoft Authenticator Transfer to New Phone (With or Without Old)

Microsoft Authenticator doesn’t move everything to a new phone. Its backup restores the one-time codes for personal Microsoft accounts and third-party accounts like Google or Amazon. For work or school accounts, Microsoft says only the account name comes back: you have to sign in again, and in practice you set the new phone up as a fresh sign-in method.

Two more rules catch people out. Backups only restore to the same kind of phone, iPhone to iPhone or Android to Android. And the easiest moves happen while you still have the old phone, because you can use it to approve the new one.

So don’t wipe or trade in the old phone yet. Work through the steps below, test every account on the new phone, and only then remove the old one.

What moves to the new phone and what doesn’t

Microsoft’s platform rule is strict: accounts backed up on an iPhone can’t be restored on an Android phone, and the reverse. If you’re switching platforms, plan to add every account again by hand.

Push notifications are tied to the registered device. Microsoft notes that a push notification goes to the device where Authenticator was last used, so while the old phone is still registered and active, prompts can land there instead of on the new phone.

Before you switch: back up the old phone

iPhone

On iPhone, Authenticator backs up through iCloud. Microsoft’s current steps:

1. Turn on iCloud Drive, iCloud Keychain and iCloud Backup for your Apple Account.
2. In your iCloud settings, open the list of apps saving to iCloud, find Authenticator and turn it on.
3. Update Authenticator to version 6.8.33 or later and open it at least once before you switch phones.

Android

1. Open Authenticator, tap the menu, then Settings.
2. Turn on Cloud Backup and choose the personal Microsoft account to store it in. A work account can’t hold the backup.
3. If you picked the wrong recovery account, turn backup off (which deletes it) and turn it on again with the right one.

Microsoft has announced that from January 2027, Android backups will no longer use a Microsoft personal account; you’ll turn on Microsoft Authenticator in Google One backup instead. If you’re reading this after that date, look for Authenticator in your phone’s Google backup settings.

On the new phone: restore personal and third-party accounts

iPhone to iPhone: sign in with the same Apple Account, make sure the same iCloud settings are on, then install Authenticator. The backup should appear; Microsoft then has you sign in to each account to complete the restore. If the backup doesn’t appear, Microsoft’s fix is to uninstall and reinstall Authenticator on the new phone.

Android to Android: install Authenticator and choose Restore from backup before adding any accounts, then sign in with the personal Microsoft account that holds the backup. If you don’t see Restore from backup or Begin recovery, sign out of or remove every account in the app first; the option only appears in an empty app.

After restoring, some accounts may say Action required or Sign in to restore your account. Tap each one, sign in and confirm with your email or phone number.

Then test every account: sign in to each site using a code from the new phone. Only when all of them work should you erase the old phone.

Work or school accounts: set the new phone up again

If you still have the old phone, you can do this yourself in about five minutes:

1. On a computer, go to mysignins.microsoft.com/security-info and sign in, approving the request on the old phone.
2. Choose Add sign-in method, pick Microsoft Authenticator and click Add, then Next until a QR code appears.
3. On the new phone, open Authenticator, tap + > Work or school account > Scan a QR code and scan it.
4. Approve the test notification on the new phone.
5. If the page offers it, make the new phone your default sign-in method.
6. Delete the old phone’s Microsoft Authenticator entry from the Security info page.

That last step matters. Microsoft says deleting the app from the old phone isn’t enough; you also have to remove the old device from your account, or sign-in prompts can keep going to it.

Passkeys don’t transfer

If you sign in with a passkey stored in Authenticator, it stays on the old phone. Microsoft makes these passkeys device-bound, so no backup or restore brings them back.

Create a new one on the new phone: in Security info choose Add sign-in method > Passkey in Microsoft Authenticator and follow the prompts, or tap your account in Authenticator and choose Create a passkey. The phone needs iOS 17 or later, or Android 14 or later. Then delete the old phone’s passkey from Security info so it can’t be used.

If your company uses phone sign-in or policies that require a registered device, you may also need to register the device again under Settings > Device Registration in the app. Company phones managed with Intune may need the Company Portal app installed before Outlook and Teams will work. If your Outlook calendar stops updating on a new iPhone after the move, see Outlook calendar not syncing with iPhone.

No old phone? How to get back in

Work or school account

Lost the phone with Microsoft Authenticator? Your work account has other ways in. On the sign-in prompt, choose I can’t use my Microsoft Authenticator app right now (or Sign in another way). If you registered a text or call to your mobile number and kept that number on the new phone, the code arrives there, which is usually the fastest way back in. Use it to reach Security info, add the new phone as above, and delete the old Authenticator entry.

If Authenticator was your only method, you can’t fix it yourself: your Microsoft 365 admin has to reset it. That’s deliberate; otherwise anyone with your password could add their own phone.

Personal Microsoft account

Sign in at account.microsoft.com/security with another verification method you’ve set up, such as an alternate email or phone number, and add Authenticator again under Manage how I sign in.

If you can’t verify at all, use Microsoft’s account recovery process, but know the limits: Microsoft warns that with two-step verification on, your password alone won’t get you back in, regaining access can take 30 days, and you can lose the account.

That’s why, before you switch phones, you should check that Manage how I sign in lists at least one more method, such as an alternate email or phone number. Microsoft is also clear that its support agents can’t restore an Authenticator backup for you if you’ve lost access to the account holding it.

Third-party accounts

Without a backup, each service has its own recovery: backup codes you saved when you turned on two-step verification, a recovery email, or an identity check. Start with the accounts that protect money and email.

For Microsoft 365 admins: reset a user’s MFA

You need at least the Authentication Administrator role, which can only reset users who hold no admin role. To reset another admin, including a Global Administrator, you need the Privileged Authentication Administrator or Global Administrator role. That matters in a small office, where the person with the new phone is often the owner and an admin.

No one can issue a Temporary Access Pass to themselves.

Verify the person’s identity before you reset anything, for example by calling them back on a number you already have. A help desk that resets MFA for anyone who phones in is a known way attackers get into accounts.

Require re-registration

1. Sign in to the Microsoft Entra admin center (entra.microsoft.com).
2. Go to Entra ID > Users, select the user, then Authentication methods.
3. Choose Require re-register MFA. Microsoft says this deletes the user’s phone numbers, Microsoft Authenticator registrations and software OATH tokens, and deactivates hardware tokens. The user sets up a new method at next sign-in.
4. If the old phone was lost or stolen, also choose Revoke sessions to force sign-in again everywhere.

Or issue a Temporary Access Pass

A Temporary Access Pass (TAP) is a time-limited code the user signs in with to register Authenticator on the new phone. First enable it under Entra ID > Authentication methods > Policies > Temporary Access Pass (this needs the Authentication Policy Administrator role). Then, on the user’s Authentication methods page, choose Add authentication method > Temporary Access Pass. By default a pass lasts one hour. Copy the code before closing the window; you can’t view it again.

Afterward, check the user’s sign-ins under Entra ID > Monitoring & health > Sign-in logs, and remove the old phone from their methods.

If you’re the only admin and you’re locked out

When you’re the only admin, no one inside your company can reset your MFA, and a remote technician can’t either without admin access to your tenant. First try every other option on the sign-in prompt: I can’t use my Microsoft Authenticator app right now or Sign in another way, a text to your number if you kept it, or a hardware token.

If none of those works, admin access has to be recovered through Microsoft’s own support for Microsoft 365 admins. Expect to prove you own the organization before they restore access, and expect it to take time.

Prevention is simple: keep at least two admin accounts, each with its own MFA, so one lost phone never locks out the only admin. Getting this right for the whole team is what our email security and 2FA setup covers.

Common snags and when to get help

• Prompts still go to the old phone. Remove the old device from Security info (work) or account.microsoft.com/security (personal).
• Codes are rejected. Set the phone’s date and time to automatic. Microsoft says Authenticator needs the phone’s clock to report the correct local time, and the codes are time-based.
• No approval prompt on the new phone. Open Authenticator and pull down to refresh, or tap Refresh. Microsoft doesn’t send notifications for sign-ins it flags as unusual, so the request only shows when you open the app.
• “Your device is jailbroken” or “rooted.” During 2026 Microsoft rolled out jailbreak and root detection for work and school accounts in Authenticator (Android from late February, iPhone from April). Affected phones get a warning first, then can’t register or use work and school credentials, so set the account up on an unmodified phone.
• Android work account won’t finish setup. Microsoft requires Google Play services and notifications to be turned on, and passwordless sign-in also needs a screen lock PIN or biometric.
• Outlook or Teams keeps asking you to sign in. Once the new phone is registered, sign in again in each app and approve on the new phone. If Outlook still shows Disconnected, see fixes for Outlook disconnected from the server.
• A lost phone you suspect someone is using. Have your admin delete the old phone’s Microsoft Authenticator entry (or require re-registration), revoke sessions, and reset the password if it might be known, then watch for signs of a compromised account.

If you’re the only admin and you’re locked out, start with Microsoft’s admin recovery described above. If you’d rather not walk a staff member through a reset alone, this is a typical $59 remote fix; you approve the session first and can stop it whenever you want. If several staff are changing phones at once, or you want user and MFA changes handled on an ongoing basis, see our Microsoft 365 support.

Common questions

Can I transfer Microsoft Authenticator from an iPhone to an Android phone?

Not with the backup. Microsoft says backups only restore on the same platform, so an iPhone backup can’t be restored on Android or the reverse. Keep the old phone, then add each account again on the new one: register work accounts through Security info, add your personal Microsoft account again, and re-enroll third-party accounts like Google from each site’s security settings.

Why didn’t my work account come back after restoring Authenticator?

For work and school accounts, Microsoft backs up only the account name, not the sign-in credential. After a restore you must sign in again, and usually register the new phone in Security info at mysignins.microsoft.com. If you no longer have the old phone or another verification method, your Microsoft 365 admin needs to reset your MFA.

How do I set up Microsoft Authenticator on a new phone without the old phone?

For a work account, sign in using another registered method, such as a text message, and add the new phone in Security info. If Authenticator was your only method, ask your admin to require you to re-register MFA on the new phone, or to give you a Temporary Access Pass. For a personal account, verify with your alternate email or phone at account.microsoft.com/security, or use Microsoft’s account recovery.

Do I need to remove Authenticator from my old phone?

Yes, but only after every account works on the new phone. Then remove it in two places: remove the old phone as a sign-in method (in Security info for a work account, or under Manage how I sign in for a personal account), and delete the app from the old phone. Microsoft says deleting the app alone isn’t enough, because sign-in requests can keep going to the device where Authenticator was last used.

Can I use Microsoft Authenticator on two phones at the same time?

Yes, for work or school accounts. Security info lets you register more than one Authenticator app, and Microsoft allows up to five authenticator apps or hardware tokens per user, so you can add the new phone while the old one still works. Microsoft says push prompts go to the device where Authenticator was last used, so if a prompt doesn’t appear, check the other phone or use a code. Delete the old phone’s entry once the new one works.

What is a Temporary Access Pass?

It’s a time-limited passcode a Microsoft 365 admin creates in the Microsoft Entra admin center. The user signs in with it, without needing their old phone, and registers Microsoft Authenticator or another method in Security info. By default it lasts one hour. The admin must enable the Temporary Access Pass policy before users can sign in with one.

Will restoring Authenticator bring back my Google and Amazon codes?

Yes, if you backed up the old phone and restore to the same type of phone. Microsoft says third-party accounts such as Google, Amazon and Facebook restore with their codes. Test each one before wiping the old phone. Without a backup, use the backup codes or recovery process each site provided when you turned on two-step verification.