Moving Microsoft Authenticator (MFA) to a New Phone

Category: Mobile Devices · Audience: Customers & Technicians · Est. time: 10–20 min

Summary

When you replace a phone, your Microsoft Authenticator (the app that approves sign‑ins) needs to be set up on the new device *before* you lose the old one — otherwise you can get locked out.

✅ Best case: set up the new phone while you still have the old one working. If the old phone is already gone, jump to "Lost the old phone" below.

Move it (you still have the old phone)

1. On the OLD phone: open Microsoft Authenticator → menu → Settings → turn on "Cloud backup" / "iCloud backup." (Requires a personal Microsoft/Apple account.)
2. On the NEW phone: install Microsoft Authenticator → Begin recovery → sign in with the same recovery account to pull your accounts back.
3. Test a sign‑in to confirm approvals now come to the new phone.
4. Some work accounts don't restore via backup and must be re‑added — sign in to aka.ms/mfasetup, remove the old device, and add the new one via "+ Add sign‑in method → Authenticator app."

Lost the old phone / can't approve sign‑ins

1. If you have another method (text/call to your number, or a backup code), use it to sign in, then go to aka.ms/mfasetup and add the new phone.
2. If you have no working method, you're locked out — contact BBN Support. After verifying your identity, we can reset your MFA so you can register the new phone.

If that doesn't work

• "It approves on the old phone, not the new one" → remove the old device at aka.ms/mfasetup and re‑add the new one.
• Escalate to BBN Support for an MFA reset — we'll verify identity first.

Prevention

• Register two methods (Authenticator and a phone number) so a lost device never locks you out.
• Set up the new phone's Authenticator before wiping/returning the old one.