Microsoft Authenticator & Microsoft Work Accounts

Work accounts cannot normally be transferred to a new phone as fully working Authenticator registrations. A cloud backup may restore the account names, but the security keys are tied to the old device. Each work account must usually be registered again with a new QR code.

Try the following:

1. Keep at least one existing phone or tablet available. Do not remove its Authenticator registration until the new phone is working.
2. Open the My Sign-Ins security information page in a private browser window and sign in with the exact work account. Make sure you are not using the security page for a personal Microsoft account.
3. Select Add sign-in method > Microsoft Authenticator or Authenticator app. Continue until the QR code appears.
4. On the new Android phone, open Authenticator and select Add account > Work or school account > Scan a QR code. Repeat this process separately for every work account.

If Authenticator is still missing from the list, check whether that account already has several Authenticator devices registered. Keep one working method and remove only an old or unused device, then try adding the new phone again.

If the option remains unavailable, this is controlled by the organization rather than the phone. An Entra administrator must check Entra admin center > Protection > Authentication methods > Policies > Microsoft Authenticator and confirm that the method is enabled for the user or a group containing the user. The administrator may also need to issue a Temporary Access Pass or require the user to register MFA again.

The fact that Authenticator still works on existing tablets does not prove that new registrations are allowed. Existing registrations can continue working even when the organization has disabled Microsoft Authenticator for new setups.