Microsoft Authenticator is the app most New Zealand workplaces standardise on, because it handles Microsoft 365 sign-ins as well as ordinary six-digit codes. It also changed significantly during 2025, which is why the instructions you find in older guides no longer match what is on your phone.
What changed in 2025
Microsoft removed the password features in stages: adding new passwords stopped in June 2025, autofill stopped in July, and saved passwords became inaccessible in the app from mid-August. Passwords moved to your Microsoft account and remain usable in Edge; saved payment information was deleted outright.
What the app still does is the part that matters: verification codes for any service that supports them, push approvals for Microsoft accounts, and passkeys for work and school accounts.
Setting it up
- Install the app from the App Store or Google Play — check the publisher is Microsoft Corporation, because imitations appear regularly.
- For a Microsoft account, sign in and follow the prompts. For any other service, choose Add account, then Other, and scan the QR code the site shows.
- Save the recovery codes the site offers at setup. Store them somewhere other than the phone running the app.
- Turn on Cloud Backup under Settings. Without it, a lost phone means recovering every account individually.
Push approvals and number matching
For Microsoft accounts the app usually sends a prompt with a number to type rather than a code to read. That design exists because of “MFA fatigue” attacks, where an attacker with your password triggers approval requests repeatedly until somebody taps Approve to stop the buzzing. Because number matching requires reading a number from the real sign-in screen, a blind tap approves nothing.
If a prompt arrives when you are not signing in, deny it and change that account’s password immediately — it means somebody already has the password.
Moving to a new phone
This is where people get locked out, so do it while the old phone still works.
- Turn on Cloud Backup on the old phone first, under Settings in the app.
- Restore to the same platform. Backups move iPhone to iPhone and Android to Android, not across.
- Expect to re-verify work and school accounts. Personal accounts and third-party codes restore; Entra work accounts need verifying again, sometimes with help from your IT administrator.
- On Android, backup currently uses a personal Microsoft account, with a move to Google One signalled for 2027.
- Keep the old phone until you have signed in successfully to every important account from the new one.
If the old phone is already gone, each service has its own recovery path: recovery codes if you saved them, then identity verification with the provider. For a work account, your IT administrator can reset the method — which is far faster than the consumer route.
Is it the right app for you?
If your job runs on Microsoft 365, yes — push approvals alone are worth it. If you want one app for personal accounts with backups that are not tied to a Microsoft account, 2FAS, Aegis on Android or Bitwarden Authenticator are open-source alternatives, and our authenticator app guide compares them. Whichever you choose, our passkey guide covers the newer approach that removes the code step entirely, and the password manager guide deals with the passwords the app no longer stores.
Disclaimer
General information only. App behaviour changes with updates; Microsoft’s own support pages document the current backup and restore process. For a work or school account, your organisation’s IT team controls the reset process.
Reference sources
Frequently asked questions
Why did Microsoft Authenticator delete my passwords?
Microsoft removed password storage and autofill from the app through 2025. Saved passwords remain in your Microsoft account and work in Edge; saved payment details were deleted.
How do I move Microsoft Authenticator to a new phone?
Turn on Cloud Backup on the old phone, install the app on the new one, sign in and restore. Backups only restore to the same platform, and work or school accounts must be verified again.
What if I lost the phone with my authenticator on it?
Use the recovery codes you saved at setup. For a work account, ask your IT administrator to reset the method. For personal accounts, each provider runs its own identity-verification process.
Can Microsoft Authenticator hold codes for non-Microsoft accounts?
Yes. Choose Add account, then Other, and scan the QR code from any service that supports authenticator apps.
What is number matching?
Instead of tapping Approve, you type a number shown on the sign-in screen. It stops attackers from spamming approval prompts until someone taps by reflex.
Does it work without internet?
Six-digit codes work offline because they are calculated from a stored secret and the time. Push approvals need a connection.
