Move Microsoft Authenticator to a new phone

Turn on backup in Microsoft Authenticator on the old phone. On the new one – iPhone to iPhone, or Android to Android – install the app and restore the backup before you sign in to anything. Codes for Google, Amazon and other services come back by themselves; work or school accounts need you to sign in again. Keep the old phone until everything works.

Before you switch: turn on backup

A Microsoft Authenticator backup can only be restored on the same kind of phone: iPhone to iPhone, or Android to Android. Microsoft Support

• iPhone: the backup is kept in iCloud. In iOS Settings › your name › iCloud, turn on iCloud Drive, iCloud Keychain (Passwords) and iCloud Backup, and check that Authenticator is turned on in the list of apps saved to iCloud. In Microsoft Authenticator, check under Settings that backup is on.
• Android: in Microsoft Authenticator, tap the menu › Settings, turn on Cloud Backup, and pick the personal Microsoft account the backup is stored with.

Update the app on the old phone and open it once before you switch.

On the new phone: restore

1. Install Microsoft Authenticator. If it came over with everything else from the old phone, delete it and install it again, so it starts empty.
2. Before you add or sign in to any account, tap Restore from backup (or Begin recovery). If you don't see it, remove the accounts in the app and open it again.
3. If asked, sign in with the personal Microsoft account you used for the backup. On iPhone, you must also be signed in to iCloud with the same Apple Account as before.
4. Open each account marked Action required and sign in to finish it.

What comes back

• Other services – Google, Amazon, Facebook, GitHub and the rest: the six-digit codes come back and work straight away.
• Your personal Microsoft account: comes back if it only uses codes. If you also use it for passwordless sign-in, only the name comes back, and you sign in again to confirm it's you.
• Work or school accounts: only the name comes back. Sign in again – your organization may ask you to register the app again (see below).

Work or school account

Organizations usually tie approvals – the number you type into Microsoft Authenticator – to one registered phone. If the account doesn't work on the new phone:

1. On a computer, open mysignins.microsoft.com/security-info and sign in. You may need the old phone one last time.
2. Add a sign-in method, choose Microsoft Authenticator, and scan the QR code with the new phone.
3. Delete the old phone from the list.

Old phone gone, and you can't sign in? Then only your IT department can help: ask them to reset your multi-factor authentication, so you can register the new phone.

The old phone is gone, and there was no backup

Then the keys went with the phone, and no one can get them back – not Microsoft either. For each service:

1. Sign in with a backup code (also called a recovery code), or use the service's account recovery.
2. Set up two-factor login again and scan the new QR code with the new phone.

For your personal Microsoft account, sign in at account.microsoft.com with another method, such as the email address or phone number on the account. If you have none, use Microsoft's account recovery form.

From Android to iPhone, or the other way

The backup can't make that jump. Keep the old phone and move one account at a time: sign in to the service, change the authenticator app in its security settings, and scan the new QR code with the new phone. Only remove the account from the old phone once you've signed in with the new code. Step by step, with links for Google, Microsoft, GitHub and others.

Codes that just come along

Kode is an iPhone app by Peter Theill ($1.99 once) for the six-digit codes, with no account and no ads. Your keys live in the iPhone's Keychain, and with iCloud Keychain – which is end-to-end encrypted – they're simply there on your next iPhone. There's no separate backup to remember.

Kode can't take over Microsoft Authenticator's codes, because Microsoft Authenticator can't export them, so you move one account at a time. And if your work requires approvals in Microsoft Authenticator, keep that app for your work account.