Authenticator app

Set the new phone’s date and time to automatic, then wait for Authenticator to generate a fresh code and try that code before starting account recovery.

Rotating Authenticator codes depend on accurate device time; incorrect date or time can cause a displayed code to be rejected.^1^

If the fresh code is still rejected

On the sign-in screen, select I can’t use my Microsoft Authenticator app right now, Sign in another way, or Show more verification methods. Use a registered email address, phone, security key, passkey, or other available method.^2^

After signing in:

• Work or school account: Go to Security info → Add method → Authenticator app → Add, and follow the QR-code setup instructions.^3^
• Personal Microsoft account: Open the Microsoft account Security tab → Manage how I sign in → Add a new way to sign in or verify, then add Authenticator or another recovery method.^4^

Do not remove the old method until the new phone successfully completes a test sign-in.

If Authenticator backup was enabled

Backup restoration works only when moving between the same device type—for example, iPhone to iPhone or Android to Android.^5^

• Android: Before signing in to Authenticator, select Restore from backup or Begin recovery, then sign in with the personal Microsoft account used for the backup.
• iPhone: Install and open Authenticator while using the relevant iCloud account and backup. For entries displaying Sign in to restore your account, tap Sign in and complete verification.

Restoration can recover eligible rotating codes for personal Microsoft and third-party accounts. It does not restore work or school credentials or passwordless credentials; those accounts must be signed in and registered again.^5^

If this is a work or school account and no alternate method works

Contact your organization’s IT help desk and request an MFA re-registration. An ordinary user who is locked out cannot perform this administrative reset.

An administrator with an appropriate Entra role can:

1. Open Microsoft Entra admin center.
2. Go to Entra ID → Users → select your account.
3. Select Authentication methods.
4. Select Require re-register MFA and confirm.^6^
5. Have you sign in again and register Authenticator on the new phone.

Administrator warning: This action removes registered phone numbers, Authenticator apps, and software OATH methods, and deactivates hardware OATH tokens. The administrator should review the impact before confirming it.^6^

If you are the tenant’s only administrator and are completely locked out, contact Microsoft Support for tenant-access verification.^2^

If this is a personal Microsoft account and no alternate method works

Select I don’t have any of these on the verification screen to begin replacing your security information. If all existing security information must be replaced, Microsoft applies a 30-day waiting period; it cannot be bypassed.^7^

References

1. Authentication did not complete | Microsoft Support
2. Unable to log into Authenticator app - Microsoft Q&A
3. Enable passwordless sign-in with Authenticator
4. Microsoft account security info & verification codes | Microsoft Support
5. Restore one-time password codes in Microsoft Authenticator | Microsoft Support
6. Manage user authentication methods for Microsoft Entra multifactor authentication
7. New Phone and Authenticator App - Microsoft Q&A