Can I move Microsoft Authenticator to a new phone myself?

Yes, as long as the old phone still works. Add the app on the new phone via the Security info page of your Microsoft account, test signing in and then remove the old phone. Only hand in the old phone after that.

Is the backup in Microsoft Authenticator enough?

Not always. After a restore, a work account often has to be verified again. Treat the backup as a convenience and make sure you also have a second sign-in method.

What does the administrator do if my phone is lost?

The administrator removes the old method in the Microsoft Entra admin center or has you re-register MFA, and can issue a Temporary Access Pass. In case of loss or theft, they also revoke existing sessions, after your identity has been verified.

What is a Temporary Access Pass?

A passcode with limited validity, optionally single-use, that lets an employee sign in and register a new sign-in method themselves. The administrator has to enable this option beforehand in the authentication methods policy.

Why does the helpdesk have to verify my identity before an MFA reset?

Because a reset lets someone link a new phone to your account. Attackers therefore pose as an employee with a lost phone. Calling back on a known number or confirmation by a colleague prevents that.

New or lost phone: how an SME moves Microsoft Authenticator and MFA safely

An employee gets a new phone, moves the apps across, trades in the old one at the shop and wants to open Outlook on Monday morning. Microsoft 365 asks for a notification in Microsoft Authenticator, but it goes to a phone that no longer exists. He calls the IT partner or a colleague, and it turns out nobody quite knows how to reset someone’s multi-factor authentication safely. Or someone calls to say they lost their phone, and the helpdesk resets everything without further questions. A few agreements prevent employees from being locked out and stop a reset from becoming a back door.

Why this goes wrong more often than you think

For many SMEs, Microsoft Authenticator is the standard second step when signing in. The app is tied to one specific phone. Someone who gets a new phone and moves their apps across usually does not yet have a working sign-in for their work account: the link with the old phone has to be replaced. If that does not happen in time, the employee is stuck, right when they want to work.

The opposite risk matters just as much. A reset of multi-factor authentication (MFA) lets someone link a new phone to an account. Attackers know this and call helpdesks with a convincing story about a lost phone. A reset without a check effectively hands the account over.

Situation 1: the old phone is still available

This is the easiest route, and the one employees should learn. As long as the old phone still works, the employee can add the new phone themselves:

Install Microsoft Authenticator on the new phone.
On a computer, go to the Security info page of the Microsoft account (via My Account or mysignins.microsoft.com) and sign in; approve with the old phone.
Choose to add a sign-in method, select the Authenticator app and scan the QR code with the new phone.
Test signing in with the new phone, make it the default method if you like, and then remove the old phone from the list.

Only then does the old phone leave the building. It helps to include this in the instructions employees receive with a new phone, and to mention it when business phones are returned or traded in.

What about the backup in the Authenticator app?

Microsoft Authenticator has a feature to back up accounts and restore them on a new phone. That is useful, but do not rely on it blindly for work accounts: after a restore, a work account often still has to be verified again, and that fails if the old method is already gone and there is no second method. Treat the backup as a convenience, not as a replacement for the route above or for a second sign-in method.

Situation 2: the phone is lost, stolen or already handed in

Now the employee cannot help themselves, unless they registered a second method. An administrator is needed. In the Microsoft Entra admin center, the administrator can remove the old method under the user’s authentication methods, or require the user to re-register MFA. At the next sign-in, the employee goes through registration with the new phone.

A cleaner option is the Temporary Access Pass. This is a passcode with limited validity, optionally single-use, that lets the employee sign in and register the new phone themselves. The Temporary Access Pass has to be enabled in the authentication methods policy beforehand. If the phone was stolen or has disappeared, also revoke the account’s existing sessions and check for unusual recent sign-ins; our article on risky sign-ins covers that. If business apps or data are on the phone, also look at the agreements on work apps on phones.

Check who is calling

The most important agreement: an MFA reset or Temporary Access Pass is only issued after the requester’s identity has been established. A name and job title are not enough, because they are often on LinkedIn or the company website. Practical checks for an SME are:

calling back on the phone number the organisation already has on file, not the number the call comes from;
a short video call with someone who knows the employee;
confirmation by the manager or a fixed contact person, through a different channel;
when in doubt: the employee comes into the office.

Also record who may request a reset and who may carry it out. Administrator accounts need a stricter check; see our article on admin accounts. And make sure you can never be locked out completely, with break-glass accounts in case the administrator loses their own phone.

Prevention: always a second sign-in method

Most emergencies disappear when every employee has at least two sign-in methods. Think of the Authenticator app plus a security key or passkey, or the app on both a business and a personal phone if that suits you. A text message code can serve as a backup method, but it is weaker than the app or a security key and should not be the only method. Also have the app use number matching, so an employee does not simply approve a notification they did not trigger.

In the authentication methods policy, you decide which methods are allowed. Check the overview of registered methods periodically to see which employees have only one method, and follow up with them. If you combine this with self-service password reset, employees use the same registered methods for both.

When people leave and phones are handed in

When an employee leaves, or a business phone is passed on to a colleague, also remove the registered sign-in methods of the old account. A phone with a working Authenticator link does not belong in a drawer or with a successor. Include this in your joiner and leaver checklist.

How Floor ICT handles this

Floor ICT agrees with you which sign-in methods your organisation allows and sets up the authentication methods policy and the Temporary Access Pass. We check who has only one method and help employees add a second one. You get short instructions for employees with a new phone and a fixed procedure for resets, including the identity check. If an employee calls us for a reset, we follow that procedure, even when it is urgent. That keeps signing in workable and stops a lost phone from becoming a way in for an attacker.

View MSP packages Request an intake Microsoft 365