Skip to main content

Replace Your Authenticator App

Goal​

Move your authenticator app to a new phone, so the new phone's codes sign you in and the old phone's no longer do.

Two-step sign-in stays on the whole time. A platform account cannot turn its authenticator off — the Shell and the Admin Control Center hold every customer's commercial record — so "turn it off, then set it up again" is not offered. Replacing is the path instead, and it never leaves your account without a factor.

Prerequisites​

  • One current code. Either a six-digit code from the app on your old phone, or one of the recovery codes you saved when you set the app up. A recovery code is the usual case: by the time most people do this, the old phone is gone.
  • An authenticator app on the new phone. Any standard one works — Microsoft Authenticator, Google Authenticator, 1Password, Bitwarden, Authy.
  • Somewhere safe for ten new recovery codes. The old ones stop working at the end of this.

Steps​

  1. Sign in to the Platform Shell. If the old phone is gone, sign in with a recovery code when the code is asked for.

  2. Open the user menu in the top corner — your initial or photo — and choose Sign-in security.

  3. Under Replace your authenticator app, enter a current code and select Replace.

    From this moment the app on the old phone no longer works. Until you finish step 5, a recovery code is what signs you in — so if you are interrupted here, you are not locked out.

  4. Set up the new phone: open the authenticator app on the new phone and scan the square code on screen. If the camera will not read it, add the account manually and type the key printed underneath.

  5. Type the six-digit code the new phone now shows and select Verify.

    If it is refused, the usual cause is the new phone's clock — turn on automatic date and time and try again. A recovery code is not accepted here: it proves you, not the phone.

  6. Save your new recovery codes. Ten new codes appear; the old set is gone. Tick I have saved these codes somewhere safe and select Finish.

What happens next​

  • The new phone's codes sign you in. The old phone's do not, even if you still have it.
  • Any other browser or device you were signed in on is signed out at its next renewal, because the factor it signed in under has changed. Your current session carries on until it expires.

If the old phone and the recovery codes are gone​

You cannot replace the app yourself: there is nothing left to prove it is you. Ask a tenant administrator to reset your authenticator — see Reset a User's Authenticator. They will confirm it is you their own way, clear the enrolment, and your next sign-in sets a new app up from scratch.

Troubleshooting​

SymptomWhat it means
"That code is not right" at step 3The old phone's code has expired (they change every thirty seconds), or the recovery code was already used. Try the next recovery code.
"That code is not right" at step 5The new phone's clock is out, or you scanned an old QR. Check automatic date and time, and start again from step 3 with another recovery code.
Too many attemptsWrong codes lock the account's second factor for a few minutes. Wait, then continue.
Sign-in security is not in the menuYou are signed in with the limited session that only reaches setup — finish setting up an authenticator first.