Our last article covered why Microsoft is moving everyone toward passkeys. This one is about the day you move your data to your new phone, wipe the old one and realize that all passkeys were lost in the process.
We are here for you!
What moves to a new phone, and what stays behind?
Microsoft's guide to transferring Authenticator, explains the limits: For work or school accounts, backup and restore brings back the account name and nothing more. The user has to sign in again to finish setup and the passkeys are handled separately from the backup. The guide asks users to create the new passkeys on the new device before they erase or trade in the old device.
On the Microsoft Tech Community thread explains that while the cloud backup may restore the account names, "the security keys remain tied to the old device." Another user objected that this was a workaround and listed what is missing: backup needs a personal Microsoft account, a business account restores only as a stub that must be approved again from the old phone, and a user who has lost that phone is stuck.
None of this is a defect. A credential that cannot be copied off a device is what strong authentication is supposed to give us. It also means the credential ends when the device does, and the people in these threads found that out after the old phone was gone.
Every answer ends at the help desk
In a thread from May, a user wrote that they had a new iPhone, had deleted the old one, and could no longer sign in to their work account. The moderator replied that only the company's IT team could reset the MFA settings. For someone who is the organization's only Global Administrator, the route is a call to Microsoft Support and a ticket for its Data Protection team. The reply includes a sample script for the automated phone menu. If that fails, it suggests creating a trial tenant and filing the request from there.
A thread from July shows what happens when the user's own IT department has no answer. A user with a new phone was told to ask their administrator to use the Require re-register MFA option in the Entra admin center. The next day they wrote back: "my IT department says they cannot help me." IT had sent them to Microsoft Support, where they could not reach a person. The moderator answered that Microsoft Support generally cannot bypass or revoke MFA for a work account without the tenant's administrator.
According to Microsoft's documentation, that reset deletes the user's registered phone numbers, Authenticator apps and software OATH tokens, and the user sets up a new method at the next sign-in. Unless the tenant restricts registration through Conditional Access, whoever signs in next with the password sets up the replacement.
The attacker makes the same call
A new phone and a missing authenticator is also the story an attacker tells. In their joint advisory on the Scattered Spider group, the FBI and CISA describe attackers who use social engineering to convince IT help desk staff to reset passwords and MFA tokens. Once inside an account, they register their own MFA tokens to keep access.
In July 2025, Clorox sued Cognizant, the company that ran its service desk, for $380 million over a 2023 cyberattack. Clorox alleges that an attacker phoned the service desk and that agents reset an employee's password and MFA without verifying who was calling. The complaint, as quoted by BleepingComputer, says the service desk came with a simple requirement: "never reset anyone's credentials without properly authenticating them first." Cognizant rejects the claims and says it was hired for a narrow scope of help desk services. These are allegations in a lawsuit, but the call they describe is the call from the forum threads, made by someone else.
A passkey protects the sign-in but has no say over the reset. If one phone call can replace the credential, the strength of the credential stops mattering.
The usual advice works against the rollout
The automated answer in the first thread ends with advice for next time. It recommends turning on Authenticator backup, keeping an alternative method such as SMS, email or a hardware key, and storing passkeys in a synced credential manager where possible.
An IT administrator reads that list differently. Backup restores only the account name for work accounts. Microsoft stops delivering SMS and voice codes for MFA for most users on February 1, 2027, unless the tenant contracts its own telephony provider. A synced passkey survives a phone change because a copy of the key sits in a cloud account, typically the employee's personal Apple or Google account. That is the custody question we covered in July. The hardware key is the one item on the list that gives the user a second credential without lowering the bar.
Hardware keys need the same planning. In a thread on Atlassian's community forum, a user who had lost the security key on their account and had no recovery key was first told that only Atlassian Support could help. A later reply described a recovery email with a 24-hour waiting period, and said that for accounts managed by an organization, only the organization's own administrator can reset two-step verification. One key per person moves the problem from the phone to the key.
Plan the replacement before the rollout
Two authenticators per user from day one. A passkey on the phone plus a hardware key, or two hardware keys. A user who loses one signs in with the other and, where self-service registration is allowed, replaces the lost one without calling anyone.
At least one authenticator that does not live on the phone. A FIDO2 security key is unaffected when the phone is replaced, wiped or traded in. SpearID FIDO2 keys can be pre-registered in Microsoft Entra ID with SpearID Now before they are handed out.
A written recovery procedure. Decide how the help desk verifies a caller before anything is reset, and who is allowed to approve it.
A Temporary Access Pass instead of a full reset. A TAP is a time-limited passcode that lets the user sign in and register a new method such as a FIDO2 key. Its default lifetime is one hour and it can be limited to a single use. It is only as trustworthy as the identity check that comes before it.
A careful look at Entra ID account recovery. This Microsoft feature replaces the help desk call with a government ID check and face match by a third-party provider, followed by a TAP. Microsoft presents it as an answer to social engineering of support staff, and asks administrators to review privacy, data retention and regional compliance requirements before deploying it.
Replacing a phone is the most ordinary thing a user will ever do with an authenticator. If the rollout plan does not cover that day, the help desk ends up deciding it on the phone, one caller at a time.
Spear Innovations helps organizations deploy phishing-resistant, hardware-backed authentication, from issuing keys to replacing and revoking them. If you are planning a passkey rollout, talk to us.