To restore Microsoft Authenticator without your old phone, restore an existing backup on the same phone platform, or sign in with another registered method and set up Authenticator again. Android backups restore to Android, and iPhone backups restore to iPhone. If neither route works, use personal-account recovery or contact your work or school administrator.
Restoring saved codes and recovering account access are separate tasks. A restored account name may still need fresh authentication before you can use it. Sign in only through Microsoft’s own app or website, and never share a code, password, or remote access with someone who contacts you.
The short version
- Existing backup: Restore it on a replacement phone using the same platform as the old phone.
- Another sign-in method: Use an accessible registered email, passkey, security key, or eligible Outlook installation to regain access.
- Fresh setup: Register the replacement phone after account recovery or assistance from your organization’s administrator.
- Other services: Recover third-party accounts through each service when their saved codes cannot be restored.
| Method or task | When it applies |
|---|---|
| Install Authenticator | Supported replacement iPhone or Android phone |
| Restore Android backup | Existing backup and original Microsoft backup account |
| Restore iPhone backup | Existing backup and original Apple Account |
| Enable iCloud Drive | Required for iPhone restoration |
| Enable iCloud Keychain | Required for iPhone restoration |
| Enable iCloud Backup | Required for iPhone restoration |
| Complete restored entries | Accounts requesting fresh authentication |
| Remove existing app accounts | Recovery options hidden by configured accounts |
| Reset Android app data | Return Android Authenticator to recovery setup |
| Reinstall on iPhone | Eligible existing backup does not appear |
| Email verification | Accessible registered personal-account email |
| Passkey or security key | Previously registered credential available elsewhere |
| Outlook approval | Eligible enrolled installation on an accessible device |
| Outlook verification code | Eligible installation displaying sign-in codes |
| Saved recovery code | Previously generated personal-account recovery code |
| Replace security information | Known personal-account password and offered recovery flow |
| Sign-in Helper and recovery form | Personal-account recovery within verification restrictions |
| Register a personal account | Successful alternate sign-in or recovery |
| Remove obsolete verification | Working replacement verification established |
| Alternate work or school verification | Another registered method permitted by your organization |
| Register through Security info | Work or school access restored |
| Register directly in Authenticator | Organization enables phone sign-in outside China |
| Administrator-issued Temporary Access Pass | Organization enables the pass for your account |
| Administrator resets or adds methods | Work or school verification needs administrator assistance |
| Organization identity verification | Configured recovery provider and pass eligibility |
| Re-enroll third-party accounts | Service access recovered and setup QR code obtained |
| Enable replacement backup | Recovered accounts ready for future backup |
Restore an Android backup
Open the Microsoft Authenticator download page, select Android or iOS, then select Get the app to reach the official store. Install Authenticator on your replacement phone. For Android recovery, begin restoration before signing into the app.
Open Authenticator and select Restore from backup; the recovery entry may instead be labeled Begin recovery. Authenticate with the personal Microsoft account originally used for backup. Eligible saved codes and account names return.
You need an existing, accessible Android backup and an Android replacement phone. An iPhone backup cannot restore to Android. If the backup account requests verification from the missing phone, use another registered sign-in method or personal-account recovery below.
Restore an iPhone backup through iCloud
Use the same Apple Account associated with your existing backup. Enable iCloud Drive, iCloud Keychain, and iCloud Backup on the replacement iPhone before opening Authenticator. Backed-up codes and account names should then appear automatically.
For iCloud Drive, open Settings, tap your name, then open iCloud. Under Saved to iCloud, open iCloud Drive and turn on Sync this iPhone. The section may instead be labeled Apps Using iCloud.
For iCloud Keychain, open Settings, tap your name, then follow iCloud > Saved to iCloud > Passwords. Turn on Sync this [Device] and supply your device passcode or Apple Account password when requested. On iOS 17 and earlier, open Passwords and Keychain instead.
Next, open Settings, tap your name, then follow iCloud > iCloud Backup and turn on Back Up This iPhone. Install and open Authenticator to restore the existing backup. Enabling backup now cannot recreate credentials stranded on the missing phone, and an Android backup cannot restore to iPhone.
If accounts do not appear, Microsoft requires that the old installation had iCloud services enabled, Authenticator enabled under Saved to iCloud, version 6.8.33 or later, and the app opened before switching. Those prerequisites cannot be repaired after the old device becomes unavailable. If they were not met, continue with alternate sign-in or account recovery.
Uninstalling removes the Authenticator app from your replacement iPhone. If you have an eligible existing backup that still does not appear, uninstall and reinstall Authenticator, then open it again.
Fix incomplete or missing restoration
Work or school credentials and personal passwordless credentials require fresh authentication after restoration. If an entry displays Sign in to restore your account, tap Sign in. For Action required, open the account tile and its recovery sign-in option, authenticate with an available method, then register the replacement device when required.
If Authenticator already contains accounts, it may hide Restore from backup or Begin recovery. Removing an account removes this installation’s ability to verify that account’s sign-ins. Open the account, tap the Settings gear, select Remove account, and repeat for every account before reopening recovery.
Clearing Android app data erases all locally configured Authenticator accounts. To return to recovery setup this way, open Android Settings > Apps > Authenticator > Storage or Storage & cache, tap Clear data, then tap OK. Reopen Authenticator and start backup restoration; settings labels may differ by manufacturer.
Sign in with another registered method
For a personal Microsoft account, choose an available alternate verification option and receive a code at an already registered email address you can access. This also works for the Microsoft account holding an Android backup. After signing in, return to restoration or register the replacement installation.
A previously registered passkey, Windows Hello credential, physical security key, or credential in a synced credential manager can provide another route. It must already be available independently of the missing phone. Choose that method and complete the offered face, fingerprint, or PIN verification; work or school use depends on organization policy.
An accessible, enrolled Outlook installation can approve sign-ins when that option is offered. Personal accounts require Outlook for Android 4.2405.0 or later; work or school accounts require organizational permission and Outlook for Android 4.2405.0 or later or iOS 4.2438.0 or later. Open the notification, match the displayed number when requested, and tap Approve.
For a code from an eligible Outlook installation, select Use a code at sign-in. In Outlook, open Home, tap the Settings gear, follow General > Accounts, choose your account, and open Sign-in requests. Copy the displayed code into the sign-in page; if Outlook redirects you to Authenticator, use another available method or continue to account recovery.
Recover a personal Microsoft account
If you saved a Microsoft account recovery code, start at account.microsoft.com/account. Select Other ways to sign in, choose Use my password, then select Forgot password? and Use a different verification option. Select I don't have any of these, then enter your saved 25-digit code at the recovery-code prompt.
The password-update step replaces your current account password. Complete that flow to continue recovery. Microsoft applies a waiting period before changes take effect for accounts with two-step verification.
If you know your password but cannot access your security information, begin signing in with that password. Replacing security information changes your account’s verification information and involves a waiting period before sign-in becomes available. At Verify your identity, select I don't have any of these if offered, then complete the replacement process. This recovers account access without restoring Authenticator’s stored codes.
For help choosing a recovery route, open Microsoft account recovery help and select Sign-in Helper. If directed to the recovery form, provide a reachable contact email and account-history information, preferably from a familiar device and location. The form cannot bypass enabled two-step verification when no alternate verification method is accessible.
Recover a work or school account
Enter your work or school credentials, then on Two-step verification, select Sign in another way. Choose an available registered method, such as another authenticator installation or code, phone verification, or a supported security key, and complete verification. A registered phone call can reach an accessible telephone independently of the lost smartphone. If the link or usable alternatives are missing, contact your administrator.
If your organization enables Temporary Access Pass for your account, ask an authorized administrator to issue one. The administrator opens the Microsoft Entra admin center and follows Entra ID > Users, selects your user, then opens Authentication methods > Add authentication method > Temporary Access Pass. They set its validity, select Add, and securely supply the pass. Open Security info, enter your account name and the pass when prompted, then register Authenticator.
Your administrator can also open Entra ID > Users, select your user, and open Authentication methods. Requiring MFA re-registration clears Authenticator registrations, phone methods, and software OATH tokens, and deactivates hardware OATH tokens. The administrator can select Require re-register MFA, or instead select + Add authentication method to add an allowed phone method. Complete replacement registration using the access method IT supplies.
If your organization deploys identity-verification account recovery, select Other ways to sign in > Recover your account at Microsoft’s work or school sign-in page. Complete the configured provider’s identity-proofing process, then open Authenticator when redirected and complete Face Check. Copy the resulting Temporary Access Pass, select Sign in, and register a replacement method in Security info.
This identity-verification route requires production mode and Temporary Access Pass eligibility. Evaluation mode does not issue a pass. If the recovery option is missing or your organization has not enabled it, contact your administrator.
Register the replacement phone
For a personal account, open your Microsoft account security settings after recovering access, then select Manage how I sign in. Select Add a new way to sign in or verify, then choose Use an app. Select Set up a different Authenticator app, then select Next.
In Authenticator, select +, choose Personal account, then select Scan a QR Code. Use the app to scan the displayed QR code from the setup screen.
Removing the obsolete personal-account verification method takes it out of your account’s verification options; preserve another working method because replacing all security information together can trigger a restriction. Once replacement verification works, open Advanced security options and expand the obsolete method. Select Remove, then select Remove again.
For a work or school account, open Security info after alternate authentication or administrator-assisted recovery. Select Add sign-in method > Microsoft Authenticator > Add > Next. In Authenticator, select + > Add account > Work or school account > Scan a QR Code, scan the displayed code, and complete verification.
If your organization enables Authenticator phone sign-in, you can also register directly in the app by selecting + > Work or school account > Sign in. Authenticate with your credentials and available verification, or an administrator-issued Temporary Access Pass. This direct route is unavailable to users in China, and credentials alone do not bypass required verification.
Reconnect accounts from other services
If another service’s account cannot be restored from backup, recover access through that service’s own recovery process. Its backup codes, alternate verification methods, and recovery requirements depend on the provider. Use its official help or account recovery page for assistance.
After recovering access, obtain the service’s authenticator-setup QR code. In Microsoft Authenticator, select +, choose Other account, and scan it. Repeat the provider’s recovery and setup process for each account whose codes you could not restore.
Enable backup on the replacement phone
On Android, open Authenticator and follow Settings > Cloud Backup. Choose a personal Microsoft account, then tap OK. This backs up the replacement installation’s accounts.
For iPhone, enable the iCloud services described above, locate Authenticator under Saved to iCloud, and enable its toggle. Enabling backup cannot create a backup of credentials that remain only on the missing phone.
Frequently Asked Questions
Can you install Microsoft Authenticator on a PC or Mac instead?
No PC or Mac version of Microsoft Authenticator is available. You need a supported iOS or Android device for the app.
Does an old version of Microsoft Authenticator still receive support?
Microsoft does not support Authenticator versions more than one year old. Install the current app on your replacement phone.
Can you retrieve a Microsoft recovery code after being locked out?
You cannot retrieve an existing recovery code while locked out. If you previously generated multiple codes, the newest code supersedes the older ones.
Why do older instructions recommend text message verification?
Microsoft is phasing out SMS authentication and recovery for personal accounts. If you have an accessible registered email address or an existing passkey, use that sign-in route.
Can your administrator add email as a work or school MFA method?
Email is not a Microsoft Entra MFA sign-in method. Your administrator can add an allowed phone method or provide another organization-approved recovery route.