Your new iPhone has your contacts and photos. Outlook opens, but signing in sends you to Microsoft Authenticator. The app shows your work account, yet no approval arrives.
For a small law office, that can interrupt access to client correspondence and shared matter documents. Start by checking whether the new phone actually has a working sign-in method. A familiar account name in the app is not enough.
Why restoring Authenticator may leave your work account unfinished
Microsoft explains that Authenticator restoration does not restore work or school account credentials. It restores the account name; completing registration requires additional sign-in.
That distinction matters during an iPhone replacement. Restoring the phone and seeing the account entry does not prove that the replacement can approve a work sign-in.
Keep the old phone available until you have tested the new one. If it has already been erased or traded in, move to the recovery options below.
If you still have the old phone, finish the change before erasing it
Use a computer and browser you trust. Keep an existing working session open while you arrange the replacement.
Sign in to your work account's Security info page at mysignins.microsoft.com/security-info. Use an existing approved method when asked.
Follow your firm's approved registration process to add Authenticator on the new phone.
Test a fresh sign-in in a separate browser session. Confirm that the replacement receives and completes the intended approval.
Check the work services you actually need, including Outlook and your firm's shared document location.
After the new method works, have obsolete methods removed according to the firm's process. Then complete the old phone's approved retirement procedure.
Microsoft's phone-transfer guidance also advises confirming access before disposing of the old device. If your firm uses passkeys, include those in the handover review rather than assuming app restoration transferred them.
If the old phone is gone, check the methods already available
At the sign-in prompt, look for an option to use another method. Use only a method already registered and allowed for that work account.
A personal Microsoft account's recovery email does not automatically become a verification method for your firm's Microsoft 365 account. Similarly, moving your mobile number to a replacement phone does not establish that a particular sign-in policy accepts that number.
If there is no usable option, contact the person responsible for your firm's Microsoft 365 administration. Avoid repeated password resets when the actual obstacle is the second verification step.
What an authorized administrator can do
After verifying your identity through the firm's established process, an administrator can review your registered authentication methods and select an appropriate recovery route.
Microsoft documents administrative options for managing authentication methods, including requiring MFA registration again. That action can remove existing methods, so it needs a planned recovery path.
Where enabled for the user, a Temporary Access Pass can help establish a replacement authentication method. It is time limited, requires authorized administration and policy configuration, and is not a universal self-service recovery code.
Do not disable MFA across the firm to solve one person's phone replacement. Never send passwords, approval codes or registration QR codes through an ordinary support inquiry.
What if the locked-out person is also the only administrator?
Tell the support provider immediately that the firm's sole administrator cannot complete MFA. Use Microsoft's official business support guidance, or the provider through whom the subscription was purchased.
Use official contact routes and be prepared for ownership verification. Recovery timing is case dependent. An outside technician cannot promise to bypass that verification.
Where Intune fits, and where it does not
Intune can be part of managing the replacement phone, but device enrollment and account authentication are separate checks. A phone may have a working authentication method and still need approved enrollment or app setup.
FMA's computer and device support can help scope the replacement workflow, including Microsoft 365 setup and device-management requirements. Treat successful sign-in and access to required work resources as separate handover tests.
Get help with the blocked sign-in
Before contacting FMA, note whether the old phone is available, whether another verification method appears, who administers the account and which work services are affected. Keep client details out of screenshots.
Get IT Help to review the problem and agree on scope and cost before paid work begins. FMA supports Maryland professional firms from Columbia, with remote support available nationwide.
