Transfer Microsoft Authenticator to a New Phone (2026)

Before You Start

Starting September 1 2026, passkeys become the default authentication experience in Microsoft Entra ID and will be automatically enabled for users previously enabled for SMS or voice, so phone transfers now involve an extra passkey setup step that the Authenticator backup does not cover. Microsoft Learn, passkeys by default and retirement of SMS and voice.

Keep your old phone until you are sure

Do not erase, trade in or recycle your old phone until you have confirmed that you can sign in to the accounts and resources you use most often from the new phone. Work and school accounts need extra sign-in steps after restore, and passkeys need to be set up again separately.

Microsoft Authenticator backs up your account entries to the cloud so you can restore them on a new phone. The backup includes your work and school account names, personal Microsoft accounts, and third-party accounts like Amazon or Facebook. But what actually gets restored depends on the account type, and passkeys are handled separately from the main backup.

The process has three parts: back up on the old phone, restore on the new phone, then set up passkeys again if you use them.

Back Up Microsoft Authenticator on iOS

Microsoft will retire its native SMS and voice MFA delivery in Entra ID on February 1 2027, which means iOS users who relied on text codes for backup recovery need to move to iCloud-backed Authenticator backup and passkeys before that date, not after. Microsoft Security Blog, Entra ID passkeys default authentication.

To back up Authenticator on an iPhone or iPad, you need iCloud Drive, iCloud Keychain and iCloud Backup all enabled, with the Authenticator toggle turned on in your iCloud settings.

Enable iCloud Drive on your iOS device.

Enable iCloud Keychain on your iOS device.

Enable iCloud Backup on your iOS device.

Go to Apple Account, then iCloud, then Saved to iCloud, and search for Authenticator.

Turn on the Authenticator toggle.

Back Up Microsoft Authenticator on Android

Android Cloud Backup inside Microsoft Authenticator links to a personal Microsoft account and is the supported restore path for Android devices, but it does not carry passkeys, which are now the default MFA experience in Entra ID from September 2026. Microsoft Learn, transfer Microsoft Authenticator to a new phone.

To back up your Authenticator account entries on an Android device, you use the Cloud Backup feature inside the app itself, linked to a personal Microsoft account.

Open Microsoft Authenticator.

Open the menu and select Settings.

Turn on Cloud Backup.

Select a Microsoft personal account where the backup will be stored.

Tap OK.

Wrong recovery account?

If you saved the backup to the wrong account, or need to change the recovery account, delete the existing backup and create a new one. You cannot switch the recovery account without starting fresh.

What Gets Restored

For work or school accounts the backup and restore process only transfers the account name so you can recognise it, and you must open the account and sign in again on the new phone, which is the step most users miss and the one that locks them out if they erase the old phone too early. Microsoft Learn, transfer Microsoft Authenticator to a new phone.

What comes back after restore depends on the account type. This is where most people get caught out.

Work or school accounts

Only the account name is restored so you can recognise it.
To complete setup on the new phone, open the account and sign in again.
You might see red text that says "Sign in to add your account." This is expected.
If passkeys are enforced for the account, set up a passkey on the new phone before removing the old device.

Personal Microsoft accounts

If the account uses only a one-time password code that refreshes every 30 seconds, the verification code entry is restored.
If the account also uses passwordless sign-in, only the account name is restored and you must sign in again to complete setup.

Third-party accounts (Amazon, Facebook, Gmail, etc.)

These accounts typically use a one-time password code that refreshes every 30 seconds.
The verification code entry is restored.

Passkeys Are Separate

Microsoft is making passkeys the default phishing-resistant authentication method in Entra ID beginning September 1 2026, and will retire native SMS and voice MFA delivery on February 1 2027, so passkeys are now the primary credential users carry on their phone and the one most at risk during a phone transfer. Microsoft Security Blog, Entra ID passkeys default authentication.

Passkeys are not included in the Authenticator backup

Passkeys are handled separately from Authenticator account backup. If a passkey was saved only to the old phone, you need to add a new passkey for the new phone. If a passkey was saved to a synced credential manager (such as Apple iCloud Keychain or Google Password Manager), it might be available after you sign in to that credential manager on the new device.

This matters more than it used to. With Microsoft making passkeys the default MFA experience in Entra ID from September 2026, more of your users will have passkeys registered. When they get a new phone, those passkeys do not automatically come across with the Authenticator restore. Each passkey needs to be set up again on the new device.

For IT admins: If your organisation does not allow self-service passkey setup, users will need to contact you or the helpdesk for the approved recovery or registration process. Make sure your support team knows the steps before the passkey rollout hits your tenant.

Set Up a Passkey on the New Phone

Microsoft publishes a passkey deployment guide for organisations preparing for the September 2026 default, and individuals set up a new passkey at aka.ms/mysecurityinfo by adding a sign-in method, which is the same URL IT admins should document in staff guides before the passkey rollout hits their tenant. Microsoft Learn, passkeys by default and retirement of SMS and voice.

After restoring Authenticator and signing back in to your work or school account, set up a passkey on the new phone if your organisation uses them.

If you still have access to the old device, use it to sign in first.

Go to Security info at aka.ms/mysecurityinfo, select Add sign-in method, and choose Passkey or Passkey in Microsoft Authenticator.

Follow the prompts to create and save the new passkey.

Test sign-in with the new passkey to confirm it works.

After the new passkey works, remove old passkeys or devices that you no longer use.

Synced credential manager?

If the passkey was saved to a synced credential manager such as Microsoft Password Manager, Google Password Manager or Apple iCloud Keychain, you might not need to create a new passkey. Verify the passkey is available on the new phone before removing the old device.

Common Issues

Restore from backup is only available when moving to the same device type, iOS to iOS or Android to Android, so users switching platforms must set up each account manually on the new phone, which is the most common reason a restore option is missing entirely. Microsoft Learn, transfer Microsoft Authenticator to a new phone.

Most problems after a phone transfer come down to one of these four issues.

Issue	Resolution
"Sign in to add your account."	Expected for work or school accounts after restore. Open the account and sign in again.
Restore from backup is not available.	Verify backup was enabled on the old phone, you are using the same recovery account, and you are restoring to the same device type (iOS to iOS or Android to Android).
No passkeys are available.	Ensure the new phone has a screen lock enabled and that Bluetooth and internet connectivity are available for cross-device sign-in.
A passkey can no longer be used.	Create a new passkey and remove obsolete passkeys only after the new method is working.

For IT Admins

Microsoft begins rolling out passkeys as the default authentication experience on September 1 2026, auto-enabling users previously on SMS or voice, so helpdesk teams need to know the restore and passkey re-registration steps before that date rather than learning them during the first wave of support calls. Microsoft Security Blog, Entra ID passkeys default authentication.

Phone replacements are one of the most common helpdesk calls. Here is what to put in place so your users can self-serve as much as possible.

Make sure Cloud Backup is enabled by default in your Authenticator app configuration

Document the aka.ms/mysecurityinfo URL in your staff IT guide so users know where to manage their sign-in methods

If you use passkeys, decide whether self-service passkey setup is allowed or if it goes through the helpdesk

Train your helpdesk team on the restore process and the "Sign in to add your account" expected behaviour

Add phone replacement steps to your onboarding and offboarding documentation

Remind staff to keep their old phone until they have confirmed sign-in works on the new one

Review break-glass accounts to make sure they do not depend on a single phone for MFA

With Microsoft making passkeys the default MFA in Entra ID from September 2026, phone transfers will involve an extra step for passkey setup. See our Entra passkey transition guide for the full timeline and what to do before the cutoff.

Common questions

Do I need to keep my old phone when transferring Microsoft Authenticator?

Yes. Keep your old phone until you can confirm you can sign in to every account and resource you use from the new phone. Work and school accounts only restore the account name, so you need to sign in again on the new device. If you erase or trade in the old phone before confirming, you could lock yourself out.

Does Microsoft Authenticator backup include passkeys?

No. Passkeys are handled separately from Authenticator account backup. If a passkey was saved only to the old phone, you need to create a new passkey on the new phone. If the passkey was saved to a synced credential manager like Apple iCloud Keychain or Google Password Manager, it may be available after you sign in to that credential manager on the new phone.

Why does my work account say "Sign in to add your account" after restoring?

This is expected behaviour. For work or school accounts, the backup and restore process only transfers the account name so you can recognise it. You need to open the account and sign in again to complete the setup on the new phone.

Can I restore Microsoft Authenticator from an iOS backup to an Android phone?

No. Restore is only available when moving to the same device type. iOS backups restore to iOS devices and Android backups restore to Android devices. If you are switching between platforms, you need to set up each account manually on the new phone.

What happens to my personal Microsoft account after restore?

If the account uses only a one-time password code that refreshes every 30 seconds, the verification code entry is restored. If the account also uses passwordless sign-in, only the account name is restored and you must sign in again to complete setup.

How do I set up a passkey on my new phone?

Sign in using your old device first, then go to Security info at aka.ms/mysecurityinfo, select Add sign-in method, and choose Passkey or Passkey in Microsoft Authenticator. Follow the prompts to create and save the new passkey, test sign-in, then remove old passkeys or devices you no longer use.

Source

Based on Microsoft Learn documentation: Transfer Microsoft Authenticator account entries to a new phone. Last updated by Microsoft on 7 July 2026. Always check the official documentation for the latest steps, as Microsoft may change the process.

Need help with MFA or passkey rollout?

We help Australian businesses deploy Microsoft Authenticator, passkeys and Conditional Access across Entra ID, including staff onboarding, device enrolment and phone replacement support.

Talk to Us Entra Passkey Guide