Quick answer
On your old phone first, turn on cloud backup in Authenticator. Install Authenticator on the new phone and choose Begin recovery to restore. Re-verify if asked, confirm your work account works, then remove your old phone from your account at aka.ms/mfasetup. Keep the old phone until the new one is proven working.
WHY ORDER MATTERS
Back up before you wipe the old phone.
The one-time codes and account registrations inside Authenticator don't automatically follow you to a new device. If you factory-reset or hand back the old phone before restoring, those codes are gone — and without them your work account may need an IT-side reset before you can sign in again. The trick is simple: turn on backup while the old phone is still in your hands, and don't remove anything until the new phone is fully working.
HOW TO MOVE IT
Do these in order.
- Turn on backup (old phone)Open Authenticator, go to Settings and switch on cloud backup — iCloud backup on iPhone, or Cloud Backup (signed in with a personal Microsoft account) on Android. This is the step people skip and later regret.
- Install Authenticator on the new phoneGet Microsoft Authenticator from the App Store or Google Play. Open it and choose Begin recovery, then sign in with the same personal Microsoft account you used for the backup.
- Restore and re-verifyYour accounts reappear on the new phone. Some work accounts will ask you to re-verify — sign in to that account or scan a QR code when prompted to confirm it's really you.
- Add your work account if it's missingIf your work sign-in isn't listed, go to aka.ms/mfasetup on a computer, remove the old entry, choose to add a sign-in method, and scan the QR code with Authenticator on the new phone.
- Test a real sign-inSign in to Outlook or your Microsoft 365 portal and approve the prompt on the new phone. If the approval lands and you get in, the move worked.
- Remove the old deviceOnce the new phone is confirmed working, go to aka.ms/mfasetup and delete the old phone from your sign-in methods. Only then wipe or hand back the old device.
- No old phone? Ask IT to reset MFAIf the old phone is already gone and backup was never on, contact your IT provider or administrator to reset your multi-factor authentication, then register fresh on the new phone.
Never approve a sign-in you didn't start. Authenticator only prompts you when someone is signing in with your account. If an approval request pops up out of the blue — one you didn't trigger — tap Deny and report it to your IT provider straight away. It usually means someone else has your password and is trying to get past your MFA.
