New Phone – Time to Update your MFA

I’ve written previous blogs on why you need MFA enabled on your accounts and an update to the user experience from Microsoft. So, now we can assume you have MFA set up for yourself and your end users and they are using the Microsoft Authenticator app as their default secondary form of authentication. However, that once shiny and new cell phone is looking old and tired. It doesn’t keep a charge like it used to. There’s one too many cracks on it. Then your carrier offers you a great new deal on a new phone that you can’t pass up. What happens to all those accounts set up in Microsoft Authenticator on the old phone? How do you transfer them to the new phone?

Before the new phone transition…

Well, before you turn that old phone in, hang on to it, as it will make life easier to transition to using Microsoft Authenticator on the new phone.

First, from the old phone, make sure cloud backup is turned on. Cloud backup requires a personal Microsoft account and for iOS devices also an iCloud account. Because iOS devices store the backup in iCloud and Android devices store the backup in Microsoft’s cloud, this process will not work if you are changing from iOS devices to Android or vice versa.

Also, on your new phone, don’t set up any accounts in Microsoft authenticator yet. If there are any, then you won’t be able to restore from a backup.

Confirm you have Cloud backup enabled. While you are in there, consider turning on App Lock. It requires a fingerprint or pin entry (whatever is set for your screen unlock security) for each actual use inside of the Microsoft Authenticator app.

confirm cloud backup of MFA app

Transitioning Microsoft MFA to New Phone

Now from the new phone, open the app and click on Begin Recovery.

adding first account to new phone MFA

Sign into the recovery account used in the first step. Also turn off Battery optimization while in the app on the new phone. When Battery optimization is on, the phone may prevent Microsoft Authenticator from doing steps it needs to do in the background such as download email from an MFA protected account.

Now that the accounts are recovered, you may notice some with a red warning exclamation point and “Action required” notice:

action required warnings

These accounts will need further evidence that you are who you say you are.

scan org QR code

This is where it is handy to have your old device still connected. Go ahead and sign into your personal security section at Microsoft. Depending on your tenant’s setup, you may have the old experience:

old MFA setup experience

Or the new experience:

new MFA setup experience

If you have the old experience, you would click on the “Set up Authenticator app” button. If you have the new experience, you would click on “+ Add method.” Walk through until you have the QR code presented on the screen. Then from your new phone scan the QR code by clicking the “Action required” text. This adds the credential needed to your new phone, and it adds this device as another approved device for the Authenticator app.

MFA Housekeeping

It would be a great idea to do some housekeeping while in this section. From the old experience screen capture, there are three entries for the “Authenticator app,” meaning there were three different devices set up for MFA for this one account. It is likely that two of those are old devices and can be safely deleted. Make sure the label next to the one you want to delete is truly the device you no longer use and click Delete.

deleting authenticator app

If you are unsure, Google the name of the device and it will likely give you a plain answer of what type of device it is.

Now that you are set, make sure it works! Sign out of your “Sign Ins” page. Close your browser (yes all of them), and open a new browser and navigate back to a page that would prompt for MFA. Either or are good choices. Sign in, get that MFA prompt, and you are set.

This publication contains general information only and Sikich is not, by means of this publication, rendering accounting, business, financial, investment, legal, tax, or any other professional advice or services. This publication is not a substitute for such professional advice or services, nor should you use it as a basis for any decision, action or omission that may affect you or your business. Before making any decision, taking any action or omitting an action that may affect you or your business, you should consult a qualified professional advisor. In addition, this publication may contain certain content generated by an artificial intelligence (AI) language model. You acknowledge that Sikich shall not be responsible for any loss sustained by you or any person who relies on this publication.

About the Author