New phone, now school authentication doesn’t work

While connected on campus, open your school account’s Security info page and register Microsoft Authenticator on the new phone before removing the old registration.

Register the new phone

1. While on the campus network, open a browser and go to My Sign-Ins → Security info: https://mysignins.microsoft.com/security-info
2. Sign in with your school account.
3. Select Add sign-in method.
4. Choose Microsoft Authenticator, then select Add or Next.
5. On the new phone:
   • Install and open Microsoft Authenticator.
   • Select + → Work or school account → Scan QR code.
   • Scan the QR code displayed in the browser.
6. Approve the test notification.
7. Test the new registration in a private browser window while using cellular data or another off-campus network.
8. Only after that test succeeds, return to Security info and remove the Authenticator entry for the old phone.

Restoring Authenticator from a phone backup does not fully restore a work or school account: only the account name is restored, and the account must be signed in and configured again on the new device.^1^

If Security info asks for approval from the old phone

Contact the school’s IT Help Desk and ask them to require MFA re-registration for your account. This reset is controlled by the school; it is not an Outlook for iOS setting.

The administrator should:

1. Sign in to the Microsoft Entra admin center with at least the Authentication Administrator role.
2. Go to Entra ID → Users.
3. Select your account.
4. Select Authentication methods → Require re-register MFA.
5. Confirm the action.

This removes the existing Authenticator, phone-number, and software OATH authentication methods. At your next sign-in, you will be prompted to register a new method, so have the new phone and Authenticator app ready.^2^

Why it may work only on campus

Your school may have a Conditional Access policy that treats the campus network as a trusted location and requires MFA when you connect from elsewhere. Educational institutions can configure access controls based on IP location and require MFA under selected conditions.^3^

If the new Authenticator registration works but off-campus access still fails, provide the IT Help Desk with:

• The exact error message or screenshot
• The date and approximate time of the failed sign-in
• Whether it fails in both Outlook and a private browser
• Whether the failure occurs on cellular data as well as home Wi-Fi

They can then distinguish an MFA registration problem from a school access policy that blocks or imposes additional requirements on off-campus sign-ins.

References

1. Transfer Microsoft Authenticator account entries to a new phone
2. Manage user authentication methods for Microsoft Entra multifactor authentication
3. Step 2: Microsoft Entra ID access controls