Lost Phone With Microsoft Authenticator? Get Back In

Your phone is lost, broken or traded in, and Microsoft 365 is still asking you to "Approve sign in request" in the Authenticator app, or to "Enter code" sent to a number you no longer have. On a new phone, the Authenticator app opens with no work account in it, or the account shows but says "Action required". Either way, you're locked out of email, Teams and files.

The good news: this is fixable, usually within minutes, but it needs the right person to do the right step. Here's what you can do, what your admin needs to do, and how to make sure it never stops work again.

Why This Happens

Multi-factor authentication (MFA) is working as intended. Your account trusts a specific device or phone number, and Microsoft can't tell the difference between you on a new phone and an attacker on theirs. Moving to a new phone doesn't automatically move a work account in Authenticator, and even when an Authenticator backup restores the account, work accounts often need extra verification before they work again.

Step 1: Try Another Sign-In Method

On the sign-in screen, look for "Sign in another way" or "I can't use my Microsoft Authenticator app right now". If you previously added a second method, such as a text to another phone, an office phone, a security key or Authenticator on a tablet, choose it.

Once you're in, go to https://mysignins.microsoft.com/security-info (or aka.ms/mysecurityinfo) and:

1. Delete the old phone's Authenticator entry and any phone number you no longer have.
2. Choose Add sign-in method and set up Authenticator on your new phone by scanning the QR code shown.
3. Set your preferred method to the new Authenticator.

Step 2: Try Restoring From an Authenticator Backup

If you replaced your phone and turned on backup in the old Authenticator app, you may be able to restore:

• iPhone: backup uses iCloud. Install Authenticator, sign in with the same Apple account and choose Begin recovery.
• Android: backup requires a personal Microsoft account. Install Authenticator and choose Begin recovery with that account.

Restored work accounts frequently show a message that further verification is needed. Tap the account and follow the prompt. If it asks you to scan a QR code, you'll need to sign in to security info using another method, or ask your admin for help.

Step 3: Contact Your Admin

If you can't sign in another way, you need your Microsoft 365 administrator. Expect them to verify who you are before they help, ideally on a video call or in person. That's good security: helpdesk impersonation is a well-known way attackers bypass MFA.

For Your Microsoft 365 Admin

Verify the user's identity first. Then, in the Entra admin centre, open Users, select the user and go to Authentication methods. You have three main options:

1. Remove the old methods. Delete the lost phone's Authenticator registration and any old phone numbers listed.
2. Require re-register multifactor authentication. This option on the same page makes the user set up MFA again at their next sign-in. It works best when they can still sign in with their password from a trusted location.
3. Issue a Temporary Access Pass (TAP). A TAP is a time-limited passcode that lets the user sign in and register new methods without the old phone. First make sure Temporary Access Pass is enabled in the Authentication methods policies (look under Protection or Authentication methods). Then, on the user's Authentication methods page, choose Add authentication method and select Temporary Access Pass. Set a short lifetime and one-time use, and give the code to the user over a separate, verified channel.

With the TAP, the user goes to aka.ms/mysecurityinfo, signs in, and registers Authenticator on the new phone plus a backup method.

If the phone may be in someone else's hands, also choose Revoke sessions on the user's page in Entra, reset the password if there's any doubt, and retire or wipe the device in the Intune admin centre if it was enrolled.

How to Stop It Happening Again

Every user should have at least two independent sign-in methods registered. Good combinations are:

• Microsoft Authenticator on their phone, plus a FIDO2 security key or passkey kept on their keyring.
• Authenticator plus Windows Hello for Business on their work laptop.
• Authenticator plus a phone number they'll keep, such as a direct office line. Text and voice are weaker than the other options, so treat them as a fallback rather than a main method.

Turn on backup in the Authenticator app, and add a new phone before wiping the old one. For the business, keep an admin-led recovery process in writing: who can verify identity, how TAPs are issued, and what happens out of hours. Our guide to password managers covers storing recovery details safely.

When to Call in Help

If nobody in your business can manage MFA, or your only admin is the one locked out, we can help you regain access and set up recovery properly. Our cybersecurity service covers MFA design, break-glass accounts and Conditional Access, and our managed IT service handles lost devices and lockouts day to day. Contact us if you're stuck now.

Related Reading

• Microsoft 365 Sign-In Errors Explained
• Microsoft 365 Account Hacked and Sending Spam?
• Why Your Business Needs a Password Manager