Microsoft Authenticator on a new phone: move it, or get back in when the old one is gone

Setting up Microsoft Authenticator on a new phone is the single most common reason people get locked out of Microsoft 365. Not a hack. Not an outage. Someone traded in the old phone at the carrier store, and the only thing that could approve their sign-in went with it.

The good news is that the fix is boring if you do it in the right order. This guide covers the order, what to do when you skipped it, and the handful of things that make prompts stop showing up on a phone that is otherwise fine. Steps are checked against Microsoft’s own support and Entra documentation as of October 2026.

Before you switch phones: do this first

Do these while the old phone still works. All of it takes ten minutes.

Turn on backup in Authenticator. Microsoft’s backup instructions differ by platform:

• iPhone: backup goes to iCloud. iCloud Drive, iCloud Keychain and iCloud Backup all need to be on. Then in iOS settings go to your Apple Account, iCloud, Saved to iCloud, find Authenticator and turn it on.
• Android: open Authenticator, tap the menu, Settings, turn on Cloud Backup, and pick a personal Microsoft account (an Outlook.com or Hotmail address) to hold it.

Two limits matter here. A backup only restores to the same platform, so an iPhone backup will not restore onto an Android phone or the other way around. And for a work or school account, Microsoft is blunt about what comes back: only the account name. You still have to sign in again on the new phone, and you may see red text that says “Sign in to add your account.” Backup saves you retyping. It does not replace re-registering.

Add a second sign-in method. Go to your Security info page at mysignins.microsoft.com/security-info and check what is listed. If the only entry is “Microsoft Authenticator” on one phone, you have a single point of failure. Add a phone number for text or call at minimum, if your company allows it. Microsoft’s own guidance is that losing your phone means your password alone will not get you back in.

Do not wipe or trade in the old phone yet. Microsoft says to keep it until you have confirmed you can sign in to the accounts you use most from the new one. Carrier trade-in windows are usually generous. Use them.

Moving Authenticator with the old phone in hand

This is the easy path. Both phones on the desk, both on Wi-Fi.

1. Install Microsoft Authenticator on the new phone from the App Store or Google Play. If you backed up, sign in with the same Apple ID or personal Microsoft account and let it restore.
2. On a computer, open mysignins.microsoft.com/security-info and sign in. Approve the prompt on the old phone.
3. Click Add sign-in method, choose Microsoft Authenticator, and follow the prompts. It will show a QR code. In the app on the new phone, tap the plus sign, choose Work or school account, and scan it.
4. Approve the test notification on the new phone.
5. If your company uses passkeys in Authenticator, add one for the new phone the same way, through Add sign-in method, and test it before going further. Microsoft’s transfer guide is explicit about doing this before you remove the old device.
6. Sign out of Outlook, Teams and the Microsoft 365 portal and sign back in using only the new phone. If that works, go back to Security info and delete the old phone’s entry.

Now you can trade it in.

Lost, broken or wiped phone: you need your admin

If the old phone is gone and Authenticator was your only method, you cannot fix this from your side. That is by design. If a stranger could re-register MFA without the old phone, MFA would be worthless.

First, try Sign in another way on the sign-in screen. If you set up a text or call option, use it, then go straight to Security info and register the new phone as above.

If there is no other way, contact whoever runs your Microsoft 365. Here is what they do, so you know what to ask for:

• Issue a Temporary Access Pass. A Temporary Access Pass is a time-limited code that stands in for MFA long enough to register a new method. The default lifetime is one hour, and it can be set to as short as 10 minutes or as long as 30 days. You sign in with your email address and the pass, land on Security info, and add Authenticator on the new phone. Creating one needs at least the Authentication Administrator role.
• Clear the old methods. In the Entra admin center, under the user’s Authentication methods, the admin can delete the dead phone’s entry or use Require re-register MFA, which wipes registered Authenticator apps and phone numbers so you start clean.
• Revoke sessions if the phone was lost or stolen. Revoke sessions signs that device out of everything. Your password should be changed too, because a found phone with a saved login is a live risk.

A note for owners: if nobody at your company holds an admin role that can do this, the lockout becomes a support ticket with Microsoft, and those are not fast. Make sure two people can issue a pass.

Prompts not arriving, codes rejected, number matching not working

Some lockouts happen on a phone that is working fine. These are the causes we see, most common first.

Notifications are off or silenced. Check the phone’s settings for Authenticator notifications, and check Do Not Disturb or Focus mode. Inside the app, Settings has a notification toggle that needs to be on. Microsoft’s troubleshooting page also says that if one account gets notifications and another does not, remove the problem account and add it back.

Battery optimization is killing the app. Mostly an Android problem. Power-saving settings put background apps to sleep, and a sleeping Authenticator misses pushes. Microsoft’s fix is to turn off battery optimization for Authenticator.

The phone’s clock is wrong. The six-digit codes are time-based. If the date and time are set manually and drift, every code gets rejected. Set the clock to automatic, restart the phone, and try again.

Number matching looks broken. Since Microsoft made it mandatory, every Authenticator push shows a number on the screen where you are signing in, and you type that number into the app. Per Microsoft’s number matching documentation, old versions of Authenticator simply fail, so update the app first. Smartwatches are not supported, which means approving from an Apple Watch will not work. Signing in to Teams or Outlook on the same phone as Authenticator gives you a Yes/No instead of a number. That is expected. VPN logins that go through Microsoft’s NPS extension may ask for the six-digit code instead.

Prompts you did not start. This one is not a glitch. If your phone asks you to approve a sign-in and you are not signing in, someone has your password. Tap deny. If the app offers to report it as suspicious, do that too, because it flags your account as high risk for your admin. Then tell IT and change your password the same day. Number matching makes blind approval much harder, but attackers still try to talk people into reading the number aloud over the phone. We covered how these attacks start in our guide on how to spot a phishing email.

When to call

Call your IT person or provider when:

• The old phone is gone and you have no second method. You need a Temporary Access Pass, and only an admin can issue one.
• You are getting repeated prompts you did not trigger. Treat that as an active incident, not a nuisance.
• Prompts still do not arrive after you have checked notifications, battery settings and the clock.
• More than one person in the office is being prompted oddly on the same day.

If you are on a managed IT plan with us, this is a five-minute ticket. Three things are worth doing before anyone needs them: give every user a second sign-in method, make sure two people can issue a pass, and turn on suspicious-activity reporting. That setup is part of our cybersecurity work if you would rather not do it yourself. If you are setting up the rest of a new device too, our walkthrough on installing Microsoft 365 on a new PC covers the desktop side.

If your team keeps getting locked out every time someone upgrades a phone, or nobody at your company can issue a Temporary Access Pass, talk to us and we will set up recovery so the next lost phone is a short call instead of a lost day.