How to move Microsoft Authenticator to a new phone

How to move Microsoft Authenticator to a new phone

In an era where cybersecurity is paramount, two-factor authentication (2FA) has become a crucial security measure. Microsoft Authenticator, a widely-used app for 2FA, offers enhanced security compared to SMS messages. However, transitioning your 2FA accounts to a new phone can be challenging. In this guide, we will explore the process of migrating 2FA accounts when using Microsoft Authenticator.

Importance of Backup Codes

Before delving into the migration process, it is essential to emphasize the significance of backup codes. Most accounts associated with 2FA provide backup codes that serve as a lifeline if you encounter issues during the recovery process. Ensure you have a copy of these backup codes for each account before attempting to change your authenticator device.

Enabling Backup on Your Old Phone

To facilitate the recovery of accounts on a new phone, you must enable the backup option on your existing device. Open Microsoft Authenticator, tap the three vertical dots at the top right, and select “Settings.” In the “Backup” section, toggle on “Cloud Backup” for Android or “iCloud Backup” for iPhone.

This action initiates the backup process, saving your accounts to the Microsoft account linked to your Microsoft Authenticator setup. It’s crucial to understand that this backup includes encrypted data such as account usernames, verification codes, and metadata.

Authenticator utilizes AES-256 encryption and SHA-512 hashing to create a secure JSON Web Encryption blob (JWE) file. A detailed explanation of this backup and storage process is available for those seeking a deeper understanding.

Utilizing the Recovery Option on Your New Phone

Once the backup is set up on your old phone, you can proceed to install Microsoft Authenticator on your new device. Download the app from Google Play for Android or the Apple App Store for iPhone. Avoid setting up new accounts using Microsoft Authenticator until after the recovery process to prevent overwriting existing site accounts.

Open Microsoft Authenticator on your new phone and click “Begin Recovery.” Sign in to the Microsoft account linked to the backup on your old phone. This action will automatically add your accounts to Microsoft Authenticator on the new device.

Revalidating and Removing From the Old Phone

Certain accounts may require revalidation through sign-ins or scanning QR codes. Microsoft Authenticator will prompt you with instructions if revalidation is necessary. Follow the same process you underwent when initially setting up the accounts.

It is crucial to remove accounts from your old phone only after confirming successful access on the new device. Open Microsoft Authenticator on the old phone, tap the account you wish to remove, and select “Remove Account.” Additionally, check if your old phone is still listed as a valid authentication device in your 2FA accounts and remove it if necessary.

Final Steps

Once all accounts are removed from Authenticator on your old phone, you can uninstall the app. From this point forward, your new phone will be the sole provider of 2FA codes.