Start Here
Complete these checks while the old phone is still available.
Old phone and new phone
Have both devices, your MFLEX password, and a computer browser available. You may need the old phone to approve sign-in while registering the new phone.
Personal Microsoft account
Authenticator backup uses a personal Microsoft account, such as Outlook.com, Hotmail, or Live. This recovery account is not your MFLEX work account.
Enroll before installing
Complete MFLEX Intune enrollment first. On iPhone and iPad, follow the Remote Management/ADE setup. On Android, complete corporate-owned enrollment before opening Authenticator.
Same Platform Migration
Authenticator backup and restore works only within the same device family.
iPhone or iPad to iPhone or iPad
- Confirm iCloud backup and Authenticator backup on the old Apple device.
- Complete MFLEX Remote Management setup on the new Apple device.
- Open Authenticator and start recovery before adding accounts.
- Sign in with the same personal Microsoft recovery account.
Android to Android
- Confirm Cloud Backup in Authenticator on the old Android device.
- Complete MFLEX corporate-owned Android enrollment on the new device.
- Open Authenticator and start recovery before adding accounts.
- Sign in with the same personal Microsoft recovery account.
iPhone and iPad Steps
Use these steps when moving from one Apple device to another Apple device.
-
Verify iCloud on the old device.
Open Settings, tap your name, then iCloud. Confirm iCloud Drive, iCloud Keychain, iCloud Backup, and Authenticator under Saved to iCloud are enabled.
-
Confirm Authenticator backup.
Open Microsoft Authenticator, go to Settings, and confirm Cloud Backup or Saved to iCloud is enabled. Note the recovery account shown in the app.
-
Set up the new MFLEX Apple device.
Complete Apple setup and accept the MFLEX Remote Management screen. Wait for required MFLEX apps to install or for the Company Portal enrollment prompts to complete.
-
Open Authenticator and start recovery.
Open Microsoft Authenticator on the new device and select Restore from backup or Begin recovery before tapping Add account or signing in with the work account.
-
Use the same recovery account.
Sign in with the same personal Microsoft account used for Authenticator backup on the old device. After the account list returns, continue to re-registration.
Android Steps
Use these steps when moving from one company-owned Android device to another Android device.
-
Confirm Authenticator backup on the old Android device.
Open Microsoft Authenticator, open Settings, turn on Cloud Backup, and confirm the personal Microsoft recovery account used for the backup.
-
Enroll the new Android device.
Complete MFLEX corporate-owned Android enrollment. If the device uses QR code enrollment, scan the MFLEX enrollment QR code during Android setup when instructed by IT.
-
Install or open Microsoft Authenticator.
Use the managed app catalog or Company Portal if installation is required. If Authenticator is already installed by policy, open the managed app from the new device.
-
Start recovery before adding accounts.
Select Restore from backup or Begin recovery on the first screen. Do not manually add the MFLEX account first.
-
Sign in with the recovery account.
Use the same personal Microsoft account used for backup on the old Android device. After the account list restores, continue to re-registration.
Re-register Accounts After Restore
Restoring the account list does not always make the new phone trusted for sign-in.
| Account type | What may restore | What to do next |
|---|---|---|
| MFLEX work or school account | The account name usually restores, but the new phone must still be registered for MFA prompts. | Tap the MFLEX account in Authenticator and follow Sign in, Action required, or Re-register prompts. Use another available MFA method or the old phone if requested. |
| Personal Microsoft account | The account may restore, but passwordless sign-in can require another sign-in. | Open the account in Authenticator and complete any sign-in, verification, or recovery prompt shown. |
| Third-party codes | Six-digit verification codes may restore when moving within the same platform. | Test important services such as Concur or other business systems. If a code does not work, re-add the account from that service's two-step verification settings. |
Switching Between iPhone and Android
Authenticator backup cannot be restored across device families.
-
Enroll the new company-owned device.
Complete MFLEX device enrollment first, then install or open Microsoft Authenticator from the managed app source.
-
Add Microsoft Authenticator from Security Info.
On a computer, go to mysignins.microsoft.com/security-info, select Add sign-in method, choose Microsoft Authenticator, and scan the QR code with the new phone.
-
Use the old phone or a backup method to verify.
If you cannot complete the sign-in challenge, contact the MFLEX Service Desk for a Temporary Access Pass, alternate verification, or MFA reset.
-
Re-add third-party accounts manually.
Sign in to each service, open its two-step verification settings, and scan a new QR code with Authenticator. Follow the service's recovery process if the old phone is unavailable.
Final Checklist
Complete these checks before deleting old MFA methods or returning the old device.
Test access
- Sign in to Microsoft 365 or portal.office.com.
- Open Outlook and Teams on the new phone.
- Approve a real Microsoft Authenticator prompt from the new phone.
- Test any business apps that use six-digit Authenticator codes.
Clean up carefully
- Confirm at least two active MFA methods remain on your MFLEX account.
- Remove old phone entries only after the new phone works.
- Follow the MFLEX return old device guide before sending the old device to IT.
- Contact the Service Desk if any account, code, or prompt does not work.
Troubleshooting
Use these notes if migration does not work as expected.
I do not see Restore from backup or Begin recovery.
The recovery option appears before accounts are added. Remove or sign out of accounts already added to Authenticator, or delete and reinstall Authenticator from the MFLEX managed app source, then reopen the app and choose the recovery option first.
Authenticator says Action required after restore.
Open the affected account in Authenticator and follow the sign-in or recovery prompt. Work accounts often need this because only the account name restores and the new phone must be trusted again.
The backup is not found.
Confirm you are using the same personal Microsoft recovery account and the same device platform. If the old phone is still available, open Authenticator on it and verify backup settings again.
I cannot approve MFA because the old phone is gone.
Contact the MFLEX Service Desk. Ask for help with a Temporary Access Pass, alternate verification method, or MFA reset. Your password alone may not be enough to register a new Authenticator method.
Outlook or Authenticator gives an error on the new phone.
Confirm the device is enrolled and compliant in Intune. If the app still fails, delete the affected app, reinstall it from the managed app source or Company Portal, sign in again, and test access.
Authenticator says to go to aka.ms/mfasetup.
Open a browser on a computer and go to mysignins.microsoft.com/security-info. If sign-in still requires the old phone and no alternate method is available, contact the Service Desk.