Microsoft Authenticator is a free phone app that signs you in to accounts with a fingerprint, face recognition or a PIN, and can also show one-time codes for two-step verification. To move it to a new phone, back up on the old phone, install the app on the new one, and restore. Work and school accounts are the exception: Microsoft says they are not restored and must be signed in again.

What it does

Microsoft's overview says Authenticator works with Microsoft personal, work, school and other accounts. You can use it three ways:

  • To verify sign-in if you forget your password.
  • To sign in every time with a one-time code (two-step verification).
  • As the only way to sign in, by tapping an approval on your phone (passwordless).

Microsoft says the app is not available for PC or Mac, and that it no longer supports Authenticator versions more than a year old, so keep it updated. For a recent fix, see our story on the Android flaw patched in 6.2606.4246.

Set it up

  1. Install Authenticator from the Apple app store (iPhone) or Google Play (Android).
  2. Add an account. Microsoft's add-accounts page says you need the latest version of the app to do this.

Microsoft personal account

  1. Sign in at the Security tab of account.microsoft.com/security.
  2. Select Manage how I sign in, then Add a new way to sign in or verify, then Use an app.
  3. If the app is already installed, select Set up a different Authenticator app, then Next, to show the QR code.
  4. In Authenticator, tap the plus icon, choose Personal account, then Scan a QR Code.

If your camera cannot scan, Microsoft says to click "I can't scan the bar code" on your PC and tap Enter code manually on the phone.

To make Authenticator your sign-in every time, turn on Two-step verification in the same area and follow the screen. To go passwordless, turn on Passwordless account and approve the request sent to the app.

Work or school account

  1. Sign in to the Security info page at mysignins.microsoft.com/security-info.
  2. Select Add sign-in method, choose Microsoft Authenticator, then Add, then Next to show the QR code.
  3. In Authenticator, tap the plus icon, choose Add account, then Work or school account, then Scan a QR Code.

Microsoft says this works if your organization supports two-factor verification. If you see "You might be signing in from a location that is restricted by your admin", or other messages that block registration, Microsoft says to contact the administrator for your work or school account.

Other accounts

Microsoft says Authenticator also works with non-Microsoft accounts such as Amazon, Facebook, Instagram and Google. Use the "Other" tab on its add-accounts page for the steps.

Back up your codes

Microsoft's backup page says backup covers one-time password codes for eligible Microsoft personal accounts and third-party accounts such as LinkedIn and Facebook. It sets one rule up front: you can only back up and restore on the same device type, so an iPhone backup cannot be restored on Android.

On iPhone: turn on iCloud Drive, iCloud Keychain and iCloud Backup, then find Authenticator in your Saved to iCloud list and switch it on.

On Android: open Authenticator, tap the menu, then Settings, and turn on Cloud Backup. Pick a Microsoft personal account to hold the backup. Microsoft's page says this is changing in January 2027; see the backup change coming to Google One.

What is not backed up

  • Work or school accounts: only the account name is saved. You sign in and register the account again on the new phone.
  • Passwordless Microsoft accounts: the passwordless credential is not backed up. Only the name is saved, and you sign in again.

Microsoft's restore page adds one instruction: keep the old phone available until you have signed in and registered your work or school accounts on the new one.

Delete or redo a backup

If you saved the backup to the wrong account, Microsoft says to delete it and make a new one. Under Settings, Backup, turn off Cloud Backup and select OK. To make a fresh one, turn it back on and select Continue or Change account to sign in to the right account.

If you see "Something went wrong" when backing up, Microsoft says you are not signed in. Turn Cloud Backup on under Settings, Backup, and select Continue or Change account.

Move to a new phone

The restore page gives these steps. Use the same type of phone you backed up from. Microsoft's page shows separate iPhone and Android steps.

iPhone:

  1. Turn on iCloud Drive, iCloud Keychain and iCloud Backup on the new iPhone.
  2. Install Authenticator and open it. Your backed-up codes and account names appear.
  3. For any account showing "Sign in to restore your account", tap Sign in, enter your password and confirm your email address or phone number. Keep your old phone until your work or school accounts are registered again.

Android (Microsoft says the Android backup account changes in January 2027; see our story):

  1. Install Authenticator and open it, then select Restore from backup.
  2. Sign in to the personal Microsoft account you used for the backup. Your codes and account names appear.
  3. Sign in and register any work or school accounts again.

On Android, Microsoft says to select Restore from backup or Begin recovery before signing in; if you have already signed in, sign out first. If you do not see either option, remove or sign out of all accounts in the app. If an account shows "Action required", tap it, choose the sign-in option to recover it, and enter your password and a second check.

If a restore fails

  • iPhone, cannot reach iCloud: Microsoft says to contact Apple Support.
  • Android, cannot get into the backup account: Microsoft says its support agents cannot help with that, and points to its Microsoft account sign-in helper.
  • Any other reason: add the accounts again using the steps above.

If your phone is lost or broken

Microsoft's pages do not give a separate lost-phone procedure. What they support is the same path: install Authenticator on a replacement of the same type, restore from backup, then sign in to any accounts that need it. Work or school accounts always need a fresh sign-in and registration. Without a backup, Microsoft says you can add the accounts again using the add-accounts steps above.

Before you switch phones

Turn on backup first and check that it worked. Keep the old phone until each work or school account shows as signed in on the new one.

Neither tip below is a Microsoft step. Guiding Tech, Helpdesk Geek and How-To Geek all suggest removing the accounts from the old phone once the new one works. Only one of them also advises checking that the old phone is no longer a trusted device for two-step verification, and not adding accounts on the new phone before you run recovery, because recovery can overwrite matching accounts.