Backup Your Microsoft Authenticator account

Microsoft Authenticator helps make sign-in more secure and convenient by supporting multifactor authentication, verification codes, passwordless sign-in, and passkeys. When you get a new phone, you can recover supported account entries and continue using secure sign-in methods by backing up and restoring these methods. Work or school accounts require additional sign-in and setup steps after restore. Complete the transfer before you erase, trade in, or recycle your old phone.

For work or school accounts, backup and restore transfers the account name so you can recognize the account on the new phone. You still need to sign in again to complete setup. Passkeys are handled separately from Authenticator account backup. If a passkey was saved only to the old phone, add a new passkey for the new phone. If a passkey was saved to a synced credential manager, it might be available after you sign in to that credential manager.

Use the following steps to back up Microsoft Authenticator on your old phone, restore it on your new phone, and set up passkeys again when needed.

Back up Microsoft Authenticator on iOS

To back up Authenticator on an iOS device, enable iCloud Drive, Keychain, and Backup for Authenticator.

1. Enable iCloud Drive on your iOS device.
2. Enable iCloud Keychain on your iOS device.
3. Enable iCloud Backup on your iOS device.
4. Go to Apple Account > iCloud > Saved to iCloud and search for Authenticator.
5. Turn on the Authenticator toggle.

Back up Microsoft Authenticator on Android

To back up your Authenticator account entries on an Android device:

1. Open Microsoft Authenticator.
2. Open the menu and select Settings.
3. Turn on Cloud Backup.
4. Select a Microsoft personal account where the backup will be stored.
5. Tap OK.

Expected behavior after restore

Work or school accounts

• Only the account name is restored.
• To complete setup on the new phone, open the account and sign in again.
• You might see red text that says "Sign in to add your account."

  

• If passkeys are enforced for the account, set up a passkey for the new phone before removing the old device.

Steps to set up a passkey on the new phone:

1. If you still have access to the old device, use it to sign in first.
2. Go to Security info at aka.ms/mysecurityinfo, select Add sign-in method, and choose Passkey or Passkey in Microsoft Authenticator.
3. Follow the prompts to create and save the new passkey.
4. Test sign-in with the new passkey.
5. After the new passkey works, remove old passkeys or devices that you no longer use.

Personal Microsoft accounts

• If the account uses only a one-time password code that refreshes every 30 seconds, the verification code entry is restored.
• If the account also uses passwordless sign-in, only the account name is restored and you must sign in again to complete setup.

Third-party accounts (Amazon, Facebook, Gmail, etc.)

• These accounts typically use a one-time password code that refreshes every 30 seconds.
• The verification code entry is restored.

Troubleshoot common issues