A Microsoft app for iOS and Android devices that enables authentication with two-factor verification, phone sign-in, and code generation
If the old phone is broken and the Microsoft Authenticator app cannot be opened, the app itself cannot be “reset,” but access to accounts can be recovered using backup or alternative methods, depending on how things were set up.
Use these options in order:
- Use other authentication methods on the account
If other sign-in methods were configured (SMS, alternate email, security keys, etc.), use those to sign in and then remove the old Authenticator registration and add the new phone:- Sign in to the Microsoft account dashboard and go to Security > Advanced security options.
- Under Ways to prove who you are, find the entry that sends sign-in notifications to the old device (for example, Send sign-in notification with the old device name).
- Expand it and select Remove.
- Then add Microsoft Authenticator again on the new phone as a fresh method.
- If backup was enabled in Microsoft Authenticator (iOS)
If the old phone was iOS and backup was configured, accounts can be restored to a new iOS device:- On the old device (if it can still be powered on and used at least once):
- Enable iCloud Drive, iCloud Keychain, and iCloud Backup.
- In Saved to iCloud, ensure Authenticator is toggled on.
- Make sure Authenticator is version 6.8.33 or later and open the app at least once.
- On the new iOS device:
- Install Microsoft Authenticator.
- If the backup does not appear, uninstall and reinstall the app; the backup should then be offered for restore.
- On the old device (if it can still be powered on and used at least once):
- If locked out of a work or school (Microsoft 365) tenant and no other admin can reset MFA
If this is a business/education tenant and there is no other global admin who can reset MFA, the Microsoft Data Protection team must assist:- Call the Microsoft customer service phone number for the region (see Customer service phone numbers - Microsoft Support in the referenced answers).
- When prompted, clearly state that this is an Authenticator issue for Office 365 for business, that it is a company account, that the caller is an administrator, and that there are no other administrators.
- Ask to create a service request and have it escalated to the Data Protection team to reset the admin’s MFA methods.
- If direct contact is difficult, one workaround is to create a temporary trial Microsoft 365 tenant, go to the new tenant’s admin center, and open a support ticket from there explaining that access is needed to a different, existing tenant where the caller is the admin.
- If still signed in somewhere (PC or browser)
If any session is still signed in (for example, Outlook or a browser on a PC), use that session to:- Go to the account’s security settings.
- Temporarily disable two-step verification (if allowed) or remove the old Authenticator method.
- Add a new authentication method (phone, email, or new Authenticator app on the new device).
This approach resolved similar cases where users could still access their account on a computer.
If none of the above is possible (no backup, no alternative methods, no active sessions, and no other admins), recovery requires working with Microsoft support/Data Protection to verify identity and reset the authentication methods.
References:
- Microsoft Authenticator FAQs
- How to go passwordless with your Microsoft account
- Back up your accounts in Microsoft Authenticator
- How Do I Regain Access to My Account After Losing Access to Microsoft Authenticator? (Urgent Request). - Microsoft Q&A
- I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A
- I need to reset my mfa methods - Microsoft Q&A
- Cannot authenticate with E-mail when logging into Microsoft Authenticator(iOS). - Microsoft Q&A
- Requesting a Tenant Admin MFA Reset - Microsoft Q&A