Move Microsoft Authenticator to a New Phone: Backup, Restore, and Recovery Limits

Transferring Microsoft Authenticator accounts to another device does not allow for the complete restoration of the account data. Only those accounts set up to use the 30-second Time-based One-Time Password (TOTP) will be recovered in full, while workplace and school accounts will still show a name but without an associated sign-in attempt. Microsoft Authenticator backups that are created from iCloud can only restore to iPhones, whereas Android devices can only restore from Google Cloud backups.

The second issue regarding the recovery process is the manner in which recovery tokens appear during the process. The recovery token appears before the user has signed in to any other accounts. According to a Microsoft representative in a recent Microsoft Q&A on the official website, signing in to a user account will overwrite the recovery token, making it impossible to restore it after signing into another account. As such, if you believe that your account(s) have been fully restored, then they have not yet been fully restored.

What actually transfers — and which accounts come back needing more

After restoring the Authenticator, you’ll see three different conditions side by side. For some entries, the code will be generated immediately. For others, the account name will be displayed above “Sign In to Restore Account” or “Action Needed.” Lastly, there may be accounts missing that are not able to return.

The underlying differences are based on what the backup contains. When an account only requires a code, Microsoft indicates that once the restore process has completed, the codes will be available again. When the account uses the passwordless sign-in method, or if the account exists in a work or school tenant, the backup only contains the account name; therefore, the user must log back in before the sign-in method can be restored.

The following table summarizes what each account type has stored in the backup, what is restored, and what actions are required afterwards.

Authenticator Passkeys are not covered in this list. The Microsoft Entra documentation answers the question directly; Authenticator passkeys are device bound, cannot be synced, and the private keys are stored on the hardware of the device that the credential was created on, such as the iOS Secure Enclave. Therefore, a backup cannot contain these credentials because the credential never leaves the device on which it was created.

To put this into a more practical perspective — a name in the application denotes that an entry exists, but it does not mean that an associated account functions correctly.

Why an iPhone Backup Can’t Restore on Android (and What to Do Instead)

Different platforms keep backups in separate locations. While on iPhones, when a backup is created, the credentials will be stored in iCloud and the recovery account associated with them will be a Microsoft account. Conversely, when an Android device creates a backup it will use the Microsoft cloud, which will be linked to one individual Microsoft account. This is why Microsoft clearly states that you can only backup and/or restore a backup to the same type of device (e.g., iOS to iOS, Android to Android) and therefore any iOS backup will not work on an Android device. The Microsoft employee responding to the cross-platform question during the Q&A stated it similarly: all accounts must be re-registered on the new device.

In terms of cross-platform backup processes, there is nothing for the other platform to access when trying to access the backup — that is, if a backup is created using iCloud, an Android device will not be able to read that backup, and just the same, an Android backup will not have anywhere to go on an iPhone.

Re-enroll each account instead

The only process between going from one platform to another is re-registering for that platform. And even then, the old device will still be your best resource for doing so.

1. For a personal Microsoft account, sign in at account.microsoft.com/security, choose Manage how I sign in, then Add a new way to sign in or verify, and pick the authenticator app.
2. Scan the QR code with Authenticator on the new phone and confirm the code it shows.
3. For a work or school account, open the Security info page at mysignins.microsoft.com/security-info, choose Add sign-in method, pick Microsoft Authenticator, choose Work or school in the app, and scan.
4. For third-party services, open each one’s security or two-step settings and register the app there again.

Keep your old device powered up and charged during this transition, as you will most likely have to provide one last approval on that device to complete the registration process. Only once you receive confirmation from the new device should you remove your old device from your account(s).

In regards to transferring apps and pictures from one device to another, the process of transferring between two Android devices, or transferring data from iPhone through the iPhone setup process, is a separate process and has its own set of unique issues. Transferring the app itself does not transfer any codes, as those codes reside within the registration for that service.

Set Up the Backup on Your Old Phone Before Anything Else

Unless you have a backup of your old phone, the entire transfer to a new phone cannot occur. Backups only occur while the old phone is physically in your possession. How backups store data on different platforms is entirely up to the platform itself. iPhones use iCloud Drive, iCloud Keychain, and iCloud Backup before a backup can occur from an iPhone application. Android Smartphone backups are saved in association with one Microsoft personal account.

Update the old phone first

There is some housekeeping that needs to happen before you toggle any backup switches: to make a backup viewable from your new phone’s authenticator app, your previous version of the authenticator app must be version 6.8.33 or greater, as described in Microsoft’s documented troubleshooting steps regarding backup recovery. You must also have opened the previous version of the authenticator app at least once after downloading the version 6.8.33.

Turn backup on

On Android:

1. Open Microsoft Authenticator.
2. Tap the three-dot menu in the upper-right, then Settings.
3. Under Backup, turn on Cloud Backup.
4. Choose the personal Microsoft account the backup should be stored under.
5. Tap OK.

On iPhone:

1. Confirm iCloud Drive, iCloud Keychain, and iCloud Backup are on.
2. Open Settings ▸ tap your name ▸ iCloud ▸ See All beside Saved to iCloud, then make sure the Authenticator toggle is on.
3. In Authenticator, open the stacked-lines menu in the upper-left, then Settings.
4. Turn on iCloud Backup.

The final check before packaging up your old phone is to see whether you have an account associated with the old phone that you can restore. In the authenticator application on your old phone, go to Settings ▸ Backup and note the account name listed as the recovery account. If it is an account that you no longer access, correct this prior to transferring your new phone to you.

There are two warnings associated with this activity. Disabling Cloud Backup will delete your backup. The toggle for Cloud Backup is how Microsoft indicates that you’re deleting a backup, not a method of transferring a backup from one account to another. If you add any accounts to your app after creating your backup, those accounts won’t be included in the backup, and you should always re-run your backup after adding or changing anything to ensure that all accounts are backed up.

Microsoft has announced that for Android users, beginning January 2027 all backups will be moved from the personal Microsoft Account platform to a new feature called “Microsoft Authenticator” integrated within the Google One Backup product. Since we still have about 3 months until that time frame is up (September 2026), we will continue to detail how to create backups and restore them to your devices based on current options available today (the instructions listed above). Therefore, an instruction manual created now or prior to January 2027 may not reflect what the app you’re holding next year.

Restore on the New Phone: Tap Begin Recovery Before You Sign In to Anything

At all points leading to this moment, was preparation. This screen is the one thing determining if this move will succeed, along with the sequencing rule that many people overlook.

In a post within Microsoft Q&A, a user mentions that they installed the app on their new Android Phone, then signed in normally as was offered first within the app, and received an “Unable to recover. Something has gone wrong” message every time they tried, consecutively, to recover their own account (even by reinstalling the app). The response from Microsoft was very straightforward in that, “after signing in normally, the recovery token gets replaced.” Therefore, Microsoft suggests uninstalling/reinstalling the app and using the “Begin Recovery” option as the very first action.

The restore sequence

On Android:

1. Install Microsoft Authenticator. Don’t open any account setup yet.
2. Open the app, agree to the terms, and skip every prompt to sign in.
3. Tap Begin recovery or Restore from backup — you may need to scroll to find it.
4. Enter the email address of the personal Microsoft account you used for backup.
5. Enter the verification code when asked. It can be sent to the old phone, so keep that phone switched on and nearby.

On iPhone:

1. Confirm iCloud Drive, iCloud Keychain, and iCloud Backup are on and signed in to the same Apple ID as the old phone.
2. Install Microsoft Authenticator and open it.
3. Choose Restore from backup if the app offers it before setup.
4. Sign in to each account to complete the restore, as Microsoft’s restore steps describe.

One eager mistake that many users make is trying to add an account before restoring. If the option to Restore from Backup or Begin Recovery does not appear, Microsoft’s recommendation is to delete or sign out of every account associated with the app, then reopen the app. There is also a second reason for waiting: The recovery tool will overwrite any accounts added to the new Phone thus far that it matches, which is noted in Intel’s own Support Guide for anyone thinking about setting up Two Factor Authentication (2FA) early.

Finish the Job: Accounts That Restore in Name Only

An entry in this list is an unrecoverable account. Any entries showing up as ‘valid’ can be used as soon as they appear. All entries coming back as a ‘shell’ must be completed manually, one entry at a time.

To recover a personal Microsoft account with a *”Sign in to restore your account” message, from the Accounts screen, select Sign in and enter your password, then validate your email/phone number as requested. To recover a work/school account that displays an Action required* notification, select that account, select the tile for it, and select the option to sign in and recover, then follow the instructions to enter the password and perform any other verification steps. On a work/school account, this oftentimes means that you were required to scan a QR code found in your organization’s Security info page.

For third-party services, you should expect their code entries to provide a corresponding number, and if you did not get a number, you will need to re-do the registration on the service’s own security page. The Authenticator app cannot re-verify a secret from another company. Once you have migrated your passkey to the new phone, you will need to re-register it in the account’s passkey settings.

One thing that will save a lot of hassle here is performing an actual sign-in to test each account rather than relying on a notification or the name displayed on your device. The reason is that the code accounts are still generating numbers on the old phone; when you have not yet unregistered it, you can confirm the secret was correctly transferred by matching the numbers displayed on both devices.

Use a recovery ledger to track each account

Complete each account by adding the information one row at a time, and do not delete until every row has been resolved.

The escalation route is where you will go if you cannot complete the entry on your new device. For work/school accounts, you will contact your organisation’s IT department; for personal/third-party accounts, you will use the account’s security page. The retirement column is also required to be completed prior to erasing or trading in your old device.

Moving Work or School Accounts When Cloud Backup Is Blocked

A message from Authenticator states that users cannot back up their accounts to the cloud if they only have Authenticator installed on their work devices. Android stores the backup in connection to personal Microsoft accounts, causing the error message to appear when attempting to enable cloud backup on work devices. Wegner documents the workaround that follows to create a backup on the new device.

The workaround bypasses the Cloud Backup process completely. You should go to mysignins.microsoft.com/security-info and sign in to the Security Info page. Click on Add Sign-in Method and select Microsoft Authenticator. Then on the new phone select Work or School when prompted by the app and use the QR code on the computer screen to add it to the new device to approve the registration. Wegner’s guide indicates that the OLD device must authenticate the new device before the Confirmation request can be completed and recommends deleting the OLD device from the list of Security Information after the new phone has been confirmed.

Some organizations do not allow their employees to use the backup feature on their accounts, so in cases such as this, there will be no toggle available for Cloud Backup and the path described above is the usual process. Timing is important to keep in mind as this method requires the OLD phone to authenticate the registration BEFORE the move.

When the Restore Fails: Fixes for Missing Backups and Recovery Errors

The following assumes you have a backup and both devices are from the same platform. If you do have lost the old phone, skip to the next section.

If “restore from backup” or “begin recovery” never appears, it is likely that something is still on the app. Sign out of all accounts or delete any previous sign-ins, then open the Authenticator again; these options should be available to you again. For iPhone users, there is an additional fix: after the app has been opened, signed into and opened again: go into Settings > Your Name > iCloud > See All and turn off Authenticator; then re-open the application.

If you receive the message “unable to recover. Something went wrong.”, that was the sequence failure mentioned earlier. You must uninstall and reinstall the application and the first thing you must do is “begin recovery“. If this still does not work, then Microsoft states that the backup may no longer be available and all the accounts will need to be manually re-added, in addition to the third party codes through their respective reset process.

The version of this issue that iPhone users experience is a version-based version. On Microsoft Q&A, there is a thread from September 2025 that has been replied to by numerous individuals with the same advice: update the application on the old phone. Turn off the iCloud backup for the old phone and turn it back on; perform a force backup for the old phone; delete the application from the new phone and reinstall the application. The rationale for this, as cited by a poster, is that Microsoft changed the way that it holds the backup data. Both phones must be updated to the same version of the application before the new phone can access the information.

There is still one last reset option to try on an android device before giving up: By accessing the Settings app, then Apps, selecting the Microsoft Authenticator app, and then selecting Storage > Clear Data. This action will reset the app back to its initial setup. You won’t lose any of your backup on the cloud after doing this; therefore, you will see the restore option appear.

However, if you do not have access to the backup account used for the initial authentication, your restore attempt will be unsuccessful. According to Microsoft’s restoration page, their representatives are unable to assist you in this scenario; as such, you will need to re-add all of the accounts you had previously been using.

No Old Phone? The Recovery Routes That Actually Exist

With the old phone gone, the app no longer works for recovery; each account type will have its own processes for recovery.

For personal Microsoft accounts, the first step should be to use the sign-in helper, which will guide you through finding out what is stopping you from accessing your account. If you can still sign into your account, go to account.microsoft.com/security and add an alternative method of verification before removing your old dead one. The information listed in the account recovery form clearly states that accounts that have two-step verification enabled cannot be recovered in this manner, so it does not provide a backdoor to recovery. If you replace all security information at once, it will cause your account to go into a “restricted” mode for 30 days, so it is much better to have a valid verification method in place before you delete the old, dead verification method.

If you have a work or school account, the Update Security Info page contains the option “Update Info.” If you do not have any of your verification methods available to you, Microsoft’s guidance is to use the option “I don’t have any of these” and replace the entire set of verification methods. Depending on your organization, your help desk may also issue you a Temporary Access Pass or require you to re-register for MFA by contacting the admin center. Conversations regarding managed accounts are generally resolved much quicker than any self-service options available to you.

All third-party entities have their own processes in place for recovering access to a user’s account. Specifically, most of these companies provide users with a backup code or a way to request help through their customer service department. However, one member of the community made an observation that should be taken into consideration before using this method. By temporarily disabling two-step verification, users can regain access to their accounts. However, this means that the user will not have any additional security for their account until they re-enable two-step verification. It would be advisable to start with the recommended method for recovering access and then to only use this method as a last resort after understanding the risks involved.

Confirm Every Sign-In Before Retiring the Old Phone

When you restore your account, it will send you back your code entries, and then request you finish setting up your work, school, passwordless and passkey sign-ins on your own. It’s important to test each of these sign-ins prior to wiping or trading in your old phone; this means testing all sign-in names within the application, not just the names that appeared when you originally set them up. Wiping your old phone while you have a live shell account will permanently eliminate the last way that account can be verified. All that’s left is to use the official recovery processes of the services involved or contact IT for help; neither option will get you access to those accounts quickly.

Frequently Asked Questions

Will my codes keep working on the old phone after I restore?

For accounts using codes for authentication – The old phone will remain on the account until you manually delete it, so codes will be generated by both devices at the same time. The codes for approving access via push are different than the codes generated from the account registrations.

What if I’m switching from Android to an iPhone?

Do not use backups and restores between devices because backups created on one device cannot be restored to another due to how they store data. Each time you want to add an account, register it through the security page and leave the old device by your side for a final approval.

Can I use Authenticator on both phones for a while?

Absolutely – this is the safest method available to you. You should use both phones until you have confirmed that all accounts on the original phone are now verified and then remove the authorization codes for all accounts individually.

What happens if I replace all my security info at once?

Microsoft’s documentation states that your account will enter a restricted state for 30 days while you’re waiting for the change to process. Once that period concludes, the process can no longer be sped up. Adding a valid method of authentication is the safest way to proceed. After adding the correct method, then delete any invalid ones.