Log in to Authenticator app

Authenticator access must be restored according to each account’s type: recover an existing backup first, use another registered verification method if available, or have the account’s organization reset its MFA registration.

1. Restore an Authenticator backup, if one existed

This is worth checking before adding the four accounts manually. Restoration works only between the same device types—iOS to iOS or Android to Android. Eligible personal and third-party 30-second codes can be restored, but work/school credentials and personal passwordless credentials require sign-in or re-registration afterward.^1^

• Android: Before signing in to Authenticator, select Restore from backup or Begin recovery, then sign in with the personal Microsoft account originally used for the backup. If that option is absent, sign out of or remove all accounts from Authenticator first.
• iPhone: Sign in to the same iCloud account, enable iCloud Drive, iCloud Keychain, and iCloud Backup, then install and open Authenticator. For entries showing Sign in to restore your account, select Sign in and complete the additional verification.

Since manually adding the accounts has already failed, do not repeatedly retry it until the applicable recovery or reset below is completed.

2. Work or school accounts

Try Sign in another way at the MFA prompt. If another previously registered method works:

1. Open the work/school account’s Security info page: https://aka.ms/mysecurityinfo
2. Select Add sign-in method and register Authenticator on the replacement phone.
3. After confirming that approval or a code works, remove the old phone’s Authenticator method.

Users who can authenticate may manage their own methods through Security Info.^2^

If no alternative method is available, contact the administrator or help desk for each organization that issued an affected account. One administrator may handle multiple accounts if they belong to the same organization. Microsoft does not maintain a public directory of each organization’s administrators; contact the school’s technical support, company help desk, business owner, or the person who issued the account.^3^

Send the administrator these steps:

1. Sign in to the Microsoft Entra admin center with at least the documented Authentication Administrator permission.
2. Go to Entra ID → Users.
3. Select the affected user → Authentication methods.
4. Select Require re-register MFA and confirm.
5. Have the user sign in again and register the replacement phone.

This action removes the user’s registered phone numbers, Authenticator apps, and software OATH methods, so ensure the user is ready to register a new method.^2^ If the target is a privileged administrator account and that administrator cannot perform the action, another sufficiently privileged tenant administrator must handle it.

3. If an affected account is the only Global Administrator

When no other administrator can sign in, request Microsoft 365 tenant recovery/MFA reset:

1. Open Microsoft’s global support phone numbers page and call the number for your country.
2. Use wording such as:
   • Business customer
   • Authentication problem / Authenticator
   • Microsoft 365 for business
   • I am the only Global Administrator
   • No other administrator can sign in
   • Create a new tenant recovery/MFA reset support case
3. Request escalation to the Data Protection or Identity team.
4. Be prepared to verify organizational and domain ownership through the private support case.

Comparable sole-administrator lockouts have been resolved by engaging the Data Protection team through a support ticket.^4^

4. Personal Microsoft accounts

For Outlook.com, Hotmail, Live, Xbox, or other personal Microsoft accounts:

1. At sign-in, select I don’t have any of these if the old phone is the only offered method.
2. Follow the displayed security-information recovery prompts.^5^
3. If recovery does not start, use Microsoft’s Sign-in Helper from the account sign-in support page.^6^

Do not replace all accessible personal-account security information unnecessarily; changing all security information can place the account into a 30-day restricted state.^5^

References

1. [iOS](https://support.microsoft.com/authenticator/restore-account-credentials-from-microsoft-authenticator#unable-to-restore-authenticator-account-credentials)
2. Manage user authentication methods for Microsoft Entra multifactor authentication
3. Find the administrator for your work or school account | Microsoft Support
4. Urgent: Microsoft 365 tenant locked out — sole Global Admin MFA unavailable after phone replacement - Microsoft Q&A
5. Troubleshoot Microsoft verification code issues | Microsoft Support
6. I can't sign in to my Microsoft account | Microsoft Support