How to Transfer the Microsoft Authenticator App (MFA) to a New Phone

Getting a new phone is exciting, but if you use the Microsoft Authenticator app to sign in to your Microsoft 365 account (multi-factor authentication, or MFA), there is one job you must do before you wipe or get rid of the old handset: move your authenticator to the new phone.

⚠️ Do this first. Keep the old phone switched on, charged, and connected to the internet until the new phone is fully set up and working. If you dispose of the old phone first, you may be locked out of your account and will need help from IT to regain access.

Make sure you set up the new phone while the old phone still works, then dispose of the old one only once you have confirmed everything works.

Before you start

Have your old phone nearby — you’ll need it to approve a sign-in request partway through.
Have your new phone to hand, with the app store available.
Know your Microsoft 365 email address and password.
Make sure both phones have a signal or Wi-Fi connection.

Open the App Store (iPhone) or Google Play Store (Android) on the new phone.
Search for and install Microsoft Authenticator.

You don’t need to add the account on the new phone just yet — we’ll do that from the web, which links the account to the new device cleanly.

Step 2 — Go to aka.ms/mfasetup

On a PC, Mac, or the new phone, go to https://aka.ms/mfasetup.
Sign in with your Microsoft 365 email address and password.
In the Security info page, you’ll see your current sign-in methods, including the Authenticator app already registered on the old phone.

When you sign in, Microsoft will ask you to prove it’s really you. Use the old phone to approve this request — open the Authenticator app on the old phone and tap Approve, or enter the code shown on screen.

Step 4 — Add the new phone

On the Security info page, click Add sign-in method.
Choose Authenticator app, then click Add.
Choose Work or school account.
When the QR code appears on screen, open the Microsoft Authenticator app on the new phone, tap the + in the corner, and choose Work or school account → Scan QR code.
Scan the code shown on screen.
Approve the test notification that arrives on the new phone to confirm it is working.

You should now see the new phone listed as a sign-in method alongside the old one.

Step 5 — (Optional) Clean up the old entry

You can have a limited number of authentication methods, so it’s good practice to tidy up.

Back on the Security info page, find the old phone’s Authenticator entry.
Click Delete next to it — but only after you have confirmed the new phone works.

If you’re not confident, leave the old entry in place for a few days and remove it once you’ve successfully signed in with the new phone a couple of times.

Step 6 — Test it, then dispose of the old phone

Sign out of Microsoft 365 completely.
Sign back in and approve the request on the new phone.
If that works, your authenticator has been transferred successfully.

Only now should you wipe, sell, or dispose of the old phone. If you can, leave it switched off but charged for a week or so before you factory reset it — just in case you need to fall back to it.

While you’re on the Security info page, it’s worth adding a second method as a backup — for example a phone number for text or call verification, or even better, a passkey. That way, if you ever lose a phone or it’s damaged, you can still get in.

If you have already replaced your phone without setting up the new one first, see Gaining access to your Office 365 account if you have replaced your phone and have MFA enabled.

Summary

Step	Action
1	Install Microsoft Authenticator on the new phone
2	Go to aka.ms/mfasetup and sign in
3	Approve the sign-in request using the old phone
4	Add the new phone and scan the QR code
5	Delete the old phone’s entry once the new one works
6	Test signing in, then dispose of the old phone