Sort your authenticator before the old phone is gone
Your work accounts are protected by multi-factor authentication, and the second factor usually lives in an authenticator app on your phone. That app does not move across in an ordinary phone backup. So the moment the old phone is wiped, traded in, or broken, the thing that proves you are you is gone with it. Ten minutes while the old phone still works saves a morning of being locked out of your own email.
Why a phone backup does not bring it with you
Photos, contacts, and most apps restore happily onto a new handset. Authenticator enrolments deliberately do not, because an attacker who restored your backup onto their own device would otherwise inherit your second factor too. That protection is doing its job. It just means the transfer is a task you have to plan rather than something that happens for you—and it is the single most common reason we get a locked-out call.
- Authenticator enrolments are tied to the device, by design
- A restored app often looks installed but will not generate valid codes
- Losing the phone and losing account access are the same event
Before you switch
Do this while the old phone is still working and still in your hand. If you have already handed it back, skip to the recovery section below.
- Tell your IT provider you are changing phones, before the swap
- Have your laptop open—most accounts re-enrol by scanning a code on screen
- List every account in your authenticator, not just Microsoft 365
- Re-enrol each one, checking a code works before moving to the next
- Only wipe or trade in the old phone once every account is confirmed
Every account in the app needs doing separately
Staff often assume the authenticator moves as one unit. It does not. Microsoft 365 is usually the straightforward one, and then the others surface over the following fortnight—job management, accounting, trade portals, payroll—each holding its own enrolment and each needing to be re-added. Work through the whole list in one sitting rather than discovering them one at a time, generally at the least convenient moment.
If you are already locked out
This is fixable, usually inside a single phone call. We reset the authenticator from our side and can either read you a working code or send a link that keeps issuing codes for a few days, which covers you on a loan handset until the replacement arrives. Two things make it slower. First, repeated password attempts: after a couple of failures the account locks, and what was a short reset becomes a longer job—stop guessing and ring us. Second, being away from your laptop, since most accounts re-enrol by scanning a code on a screen and there is nothing to scan from the phone alone. If an app is behaving oddly after a restore rather than refusing outright, check for a pending software update, then delete and reinstall it fresh from the store instead of restoring it from a backup.
Make it a process, not a scramble
Phone changes are predictable. Handsets get replaced on a cycle, screens get broken on site, and people join and leave. Treating the authenticator as part of that process costs nothing and removes one of the most frequent interruptions to a working day. Build it into how devices are issued and returned, tell your provider before the swap rather than after, and make sure someone other than the individual knows which systems that person authenticates into.
- Add authenticator transfer to your device handover checklist
- Notify IT before a phone is replaced, not after
- Keep a record of which systems each role signs into
- Treat a lost or stolen phone as an access event, not just a hardware one
Frequently asked questions
I am getting a new phone. What should I do first?
Ring us before you wipe or trade in the old one, while you can still approve a sign-in on it. Authenticator profiles do not transfer in an ordinary phone backup, so each account needs re-enrolling—and doing that while the old phone still works turns a morning into ten minutes.
My phone broke and I cannot get into my email. How quickly can you help?
Usually within the same call. We reset the authenticator from our side and can provide a working code over the phone, or a link that keeps issuing codes for a few days so you are covered on a loan handset until the replacement arrives.
Why do I need my laptop to set up my phone?
Most accounts re-enrol by scanning a code shown on a screen. Without a second screen there is nothing to scan, which is why this cannot be finished from the phone alone while you are out on the road.
Do all the accounts in my authenticator need re-adding?
Yes, each one separately. Microsoft 365 is straightforward, but third-party systems—job management, accounting, trade platforms—each hold their own enrolment. Set aside twenty minutes rather than doing it between jobs.
Should I keep trying passwords I think might be right?
No—stop after one or two. Repeated attempts lock the account, which turns a two-minute reset into a longer job. Ring us and we will reset it properly.
Is losing a phone a security problem or just an IT one?
Both. A lost or stolen phone holds your second factor and often a signed-in mailbox, so it should be reported the same day. We can revoke sessions and re-enrol you on a replacement device.