Remote SupportBefore You Start
Keep your old phone until you are sure
Do not erase, trade in or recycle your old phone until you have confirmed that you can sign in to the accounts and resources you use most often from the new phone. Work and school accounts need extra sign-in steps after restore, and passkeys need to be set up again separately.
Microsoft Authenticator backs up your account entries to the cloud so you can restore them on a new phone. The backup includes your work and school account names, personal Microsoft accounts, and third-party accounts like Amazon or Facebook. But what actually gets restored depends on the account type, and passkeys are handled separately from the main backup.
The process has three parts: back up on the old phone, restore on the new phone, then set up passkeys again if you use them.
Back Up Microsoft Authenticator on iOS
To back up Authenticator on an iPhone or iPad, you need iCloud Drive, iCloud Keychain and iCloud Backup all enabled, with the Authenticator toggle turned on in your iCloud settings.
Enable iCloud Drive on your iOS device.
Enable iCloud Keychain on your iOS device.
Enable iCloud Backup on your iOS device.
Go to Apple Account, then iCloud, then Saved to iCloud, and search for Authenticator.
Turn on the Authenticator toggle.
Back Up Microsoft Authenticator on Android
To back up your Authenticator account entries on an Android device, you use the Cloud Backup feature inside the app itself, linked to a personal Microsoft account.
Open Microsoft Authenticator.
Open the menu and select Settings.
Turn on Cloud Backup.
Select a Microsoft personal account where the backup will be stored.
Tap OK.
Wrong recovery account?
If you saved the backup to the wrong account, or need to change the recovery account, delete the existing backup and create a new one. You cannot switch the recovery account without starting fresh.
What Gets Restored
What comes back after restore depends on the account type. This is where most people get caught out.
Work or school accounts
- Only the account name is restored so you can recognise it.
- To complete setup on the new phone, open the account and sign in again.
- You might see red text that says "Sign in to add your account." This is expected.
- If passkeys are enforced for the account, set up a passkey on the new phone before removing the old device.
Personal Microsoft accounts
- If the account uses only a one-time password code that refreshes every 30 seconds, the verification code entry is restored.
- If the account also uses passwordless sign-in, only the account name is restored and you must sign in again to complete setup.
Third-party accounts (Amazon, Facebook, Gmail, etc.)
- These accounts typically use a one-time password code that refreshes every 30 seconds.
- The verification code entry is restored.
Passkeys Are Separate
Passkeys are not included in the Authenticator backup
Passkeys are handled separately from Authenticator account backup. If a passkey was saved only to the old phone, you need to add a new passkey for the new phone. If a passkey was saved to a synced credential manager (such as Apple iCloud Keychain or Google Password Manager), it might be available after you sign in to that credential manager on the new device.
This matters more than it used to. With Microsoft making passkeys the default MFA experience in Entra ID from September 2026, more of your users will have passkeys registered. When they get a new phone, those passkeys do not automatically come across with the Authenticator restore. Each passkey needs to be set up again on the new device.
For IT admins: If your organisation does not allow self-service passkey setup, users will need to contact you or the helpdesk for the approved recovery or registration process. Make sure your support team knows the steps before the passkey rollout hits your tenant.
Set Up a Passkey on the New Phone
After restoring Authenticator and signing back in to your work or school account, set up a passkey on the new phone if your organisation uses them.
If you still have access to the old device, use it to sign in first.
Go to Security info at aka.ms/mysecurityinfo, select Add sign-in method, and choose Passkey or Passkey in Microsoft Authenticator.
Follow the prompts to create and save the new passkey.
Test sign-in with the new passkey to confirm it works.
After the new passkey works, remove old passkeys or devices that you no longer use.
Synced credential manager?
If the passkey was saved to a synced credential manager such as Microsoft Password Manager, Google Password Manager or Apple iCloud Keychain, you might not need to create a new passkey. Verify the passkey is available on the new phone before removing the old device.
Common Issues
Most problems after a phone transfer come down to one of these four issues.
| Issue | Resolution |
|---|---|
| "Sign in to add your account." | Expected for work or school accounts after restore. Open the account and sign in again. |
| Restore from backup is not available. | Verify backup was enabled on the old phone, you are using the same recovery account, and you are restoring to the same device type (iOS to iOS or Android to Android). |
| No passkeys are available. | Ensure the new phone has a screen lock enabled and that Bluetooth and internet connectivity are available for cross-device sign-in. |
| A passkey can no longer be used. | Create a new passkey and remove obsolete passkeys only after the new method is working. |
For IT Admins
Phone replacements are one of the most common helpdesk calls. Here is what to put in place so your users can self-serve as much as possible.
With Microsoft making passkeys the default MFA in Entra ID from September 2026, phone transfers will involve an extra step for passkey setup. See our Entra passkey transition guide for the full timeline and what to do before the cutoff.
Frequently Asked Questions
Q.Do I need to keep my old phone when transferring Microsoft Authenticator?
Yes. Keep your old phone until you can confirm you can sign in to every account and resource you use from the new phone. Work and school accounts only restore the account name, so you need to sign in again on the new device. If you erase or trade in the old phone before confirming, you could lock yourself out.
Q.Does Microsoft Authenticator backup include passkeys?
No. Passkeys are handled separately from Authenticator account backup. If a passkey was saved only to the old phone, you need to create a new passkey on the new phone. If the passkey was saved to a synced credential manager like Apple iCloud Keychain or Google Password Manager, it may be available after you sign in to that credential manager on the new phone.
Q.Why does my work account say "Sign in to add your account" after restoring?
This is expected behaviour. For work or school accounts, the backup and restore process only transfers the account name so you can recognise it. You need to open the account and sign in again to complete the setup on the new phone.
Q.Can I restore Microsoft Authenticator from an iOS backup to an Android phone?
No. Restore is only available when moving to the same device type. iOS backups restore to iOS devices and Android backups restore to Android devices. If you are switching between platforms, you need to set up each account manually on the new phone.
Q.What happens to my personal Microsoft account after restore?
If the account uses only a one-time password code that refreshes every 30 seconds, the verification code entry is restored. If the account also uses passwordless sign-in, only the account name is restored and you must sign in again to complete setup.
Q.How do I set up a passkey on my new phone?
Sign in using your old device first, then go to Security info at aka.ms/mysecurityinfo, select Add sign-in method, and choose Passkey or Passkey in Microsoft Authenticator. Follow the prompts to create and save the new passkey, test sign-in, then remove old passkeys or devices you no longer use.
Source
Based on Microsoft Learn documentation: Transfer Microsoft Authenticator account entries to a new phone. Last updated by Microsoft on 7 July 2026. Always check the official documentation for the latest steps, as Microsoft may change the process.
Need help with MFA or passkey rollout?
We help Australian businesses deploy Microsoft Authenticator, passkeys and Conditional Access across Entra ID, including staff onboarding, device enrolment and phone replacement support.