Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteSome links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
To add a backup sign-in method to a Microsoft work or school account, open Microsoft Security info, sign in, choose Add sign-in method (sometimes shown as Add method), select an option allowed by your organization, and complete its verification. Test the new method while your existing method still works, then keep both registered.
Microsoft Authenticator is convenient, but a FIDO2 security key or passkey can provide stronger phishing resistance when your organization permits it. If the button is missing, your tenant policy may block self-service registration; an administrator or help desk must then provide the approved recovery process.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →How do I add a second authentication method to my Microsoft work account?
The entire process is managed from the account’s Security info page. You do not need to remove your current authenticator first, and deleting it before the replacement works can lock you out.
- Open https://aka.ms/MySecurityInfo in a browser and sign in with the work or school account you want to protect. You can also reach the page through your Microsoft account portal by opening Security info.
- On the Security info page, select Add sign-in method. Some tenants display the same control as Add method.
- Choose a method that appears in the list. The available choices are controlled by your organization and can include Microsoft Authenticator, phone, passkey, FIDO2 security key, or another method enabled by the tenant.
- Follow the on-screen enrollment flow. Depending on the method, you may scan a QR code, approve a number-matching prompt, enter a PIN, touch a security key, or complete a fingerprint or face-recognition check.
- When enrollment finishes, start a test sign-in and deliberately choose the new method. Confirm that it works before changing or deleting anything else.
- Keep two working methods whenever your organization allows it. Remove a lost, replaced, or retired method only after the replacement has passed a real sign-in test.
The method is added to this work account only; registering it does not automatically protect other Microsoft accounts or personal accounts on the same device. If you administer several tenants, repeat the process for each account.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What information is being registered?
Microsoft Entra keeps authentication-method registration separate from ordinary profile details. A work account can have contact information used for account recovery and authentication methods used to satisfy a multifactor challenge. Seeing a phone number or email address in an account profile therefore does not prove that it is usable for MFA. Security info is the authoritative page for the methods that can approve a sign-in.
Which backup methods can I use, and how do they differ?
Your tenant determines which methods are offered. The table below shows the practical differences that matter when you choose a backup.
| Method | What it does | Security and recovery profile | Important limitations |
|---|---|---|---|
| Microsoft Authenticator | Push approvals, one-time verification codes, passwordless phone sign-in, and passkeys. | Convenient and supports several sign-in modes; the phone is still a dependency unless you have another registered method. | Available on Android and iOS, but a restored work account still needs sign-in and setup on a replacement phone. |
| FIDO2 security key | A physical key used for a security-key sign-in. | Phishing-resistant and independent of a particular phone. It is a strong choice when you need an offline backup. | Requires a compatible key and the tenant must allow security-key registration. Losing the key means relying on another method. |
| Passkey | A cryptographic credential unlocked with a device PIN, fingerprint, or face recognition. | Phishing-resistant. It may be device-bound or synchronized through a credential manager. | A passkey on a replacement phone may need to be registered separately; synchronization behavior depends on the credential manager and policy. |
| Phone (SMS or voice) | Receives a text message or automated voice call with a verification code. | Independent of an authenticator app, but weaker against phishing and phone-number attacks than FIDO2 or passkeys. | Only appears when the tenant enables it. Administrators control which phone method and number can be used. |
| May be available for self-service password-reset contact information. | Not a general substitute for a multifactor authentication method in the administrator workflow. | Do not assume an email address can approve an MFA challenge for a work account. |
How should I compare the choices?
Use five questions: How resistant is the method to phishing? Does it depend on the phone or number you could lose? How much setup friction is acceptable? Can you carry or access it on another device? Can you test it without disrupting your current login?
A FIDO2 key is normally the most independent option: it is a separate physical credential and can work when your phone is dead, erased, or unavailable. Check the key’s connector or NFC support, operating-system and browser compatibility, and whether your tenant permits that type of security key. Keep it somewhere accessible but protected; a key locked away in an office is not useful during an urgent sign-in.
A passkey provides similar phishing resistance. Some passkeys are bound to one device, while others synchronize through a credential manager. A synchronized credential is portable, but your organization may still require a separate registration on a replacement phone. Treat every new device as a registration that must be tested.
Authenticator offers the broadest set of everyday options in one app. It can display a one-time code when push is unavailable and can support passwordless sign-in and passkeys. It is still tied to the phone’s availability, battery, unlock protection, and app registration.
SMS or voice may be a practical fallback when stronger methods are unavailable, but a phone number can be targeted through phishing, number takeover, or service outages. Use it only when the tenant enables it and do not assume it provides the same protection as a FIDO2 key or passkey.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Microsoft encourages strong methods such as FIDO2 keys, passkeys, and Windows Hello for Business. Microsoft Entra ID does not impose a universal “two-method minimum,” but organizations are encouraged to register at least two strong methods so one lost or deleted device does not cause a lockout.
How do I set up Microsoft Authenticator on a new phone?
If the old phone still works, prepare it before wiping or trading it in. Cloud backup can help restore the account entry, but restoration does not by itself complete the work-account registration.
When you still have the old phone
- Open Microsoft Authenticator on the old phone and enable its cloud-backup feature. The exact backup label differs between Android and iOS.
- Leave the old registration intact while you move to the new phone. Do not erase, factory-reset, or trade in the old device yet.
- Install Microsoft Authenticator on the replacement phone from the official Android or iOS app store, then update it before beginning enrollment.
- Open the app and use Add account > Work or school account.
- When the Security info page presents a QR code or sign-in prompt, scan the code or follow the displayed prompts. Complete number matching, a code entry, or any PIN or biometric request.
- If the account entry appears through backup restore, select it and finish the requested sign-in. The restored name or tile is not proof that the new phone is active.
- Perform a test sign-in from a browser or another service while the old phone remains available. Only after that test should you remove the old phone’s registration.
Keep the old phone connected to Wi-Fi or cellular service during the test, and make sure notifications are permitted on the new phone. Battery-saving settings, blocked notifications, an incorrect device date, or an app that has not been updated can make a valid registration appear broken.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhy does a restored account still ask me to sign in?
A work or school account restored from Authenticator backup can retain the account name but still require a fresh sign-in and registration. This is expected protection against treating a copied app state as proof that the new device is trusted. Complete the displayed sign-in, QR-code scan, number matching, and any device unlock request instead of assuming the restore failed.
What if my organization requires passkeys?
Register a new passkey on the replacement phone and test it before deleting the old passkey. A passkey that was device-bound to the previous phone will not necessarily move with an Authenticator backup. If your credential manager synchronizes passkeys, confirm that the work account’s policy allows synchronization and still perform a sign-in test on the replacement device.
What should I do if I lost the phone with Microsoft Authenticator?
The correct recovery path depends on whether another method is already registered. Do not keep approving unexpected prompts while trying to locate a lost device; report suspicious requests and remove the device as soon as you regain access.
If another method still works
- Use the working method to reach Security info. Choose Use another method on the sign-in screen if necessary.
- Select Add sign-in method and register Authenticator on the new phone, a passkey, or a security key that your tenant allows.
- Complete and test the new registration with a normal sign-in.
- Remove the lost phone’s Authenticator entry so it can no longer approve requests. If the phone may be compromised, do this promptly and ask support whether sessions should also be revoked.
If no registered method works
Do not assume Authenticator backup will solve the problem after the phone is gone. Contact your Microsoft 365 or Microsoft Entra administrator or help desk and follow the organization’s approved reset procedure. Depending on the tenant, an administrator may issue a Temporary Access Pass, require MFA re-registration, or remove the lost method before you can enroll a new one. A Temporary Access Pass is a temporary recovery credential, not a permanent replacement for your normal methods; use it only as directed by the administrator.
Recommended Free Tools
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Tell the administrator that the old device is unavailable, whether it was lost or replaced, and which new method you want to use. They may revoke sessions, remove the lost method, and provide a controlled enrollment window.
Why can’t I see “Add sign-in method”?
A missing button usually reflects tenant policy rather than a browser problem. Users can manage their own methods only when the organization permits self-service registration.
- Authentication-method policy: Administrators choose whether Authenticator, phone, passkeys, security keys, or other methods are available. A method can be enabled for one group and hidden from another.
- Conditional Access: Access rules can require a particular method, restrict registration to managed devices, require a compliant network, or prevent enrollment from the current context.
- Registration campaign or re-registration: The tenant may be moving users to Authenticator or requiring a fresh setup. Follow the campaign prompt rather than deleting existing methods.
- Role or account limits: Some accounts are managed entirely by an administrator, or the user may lack permission to change methods.
- Recovery controls: If you have no usable method, only the organization’s administrator may reset registration or provide a temporary recovery credential.
Ask the Microsoft 365 or Microsoft Entra administrator which methods the tenant supports and whether your account is allowed to add one. Avoid repeatedly deleting methods in an attempt to make the control appear; that can leave you locked out.
How do I verify that the backup really works?
Registration is not complete until you have exercised the method in a sign-in.
- Keep the original method available.
- Open a private browser window or sign out of a Microsoft work-account session. Use a service that normally prompts for MFA, not merely the Security info page you just viewed.
- Start a normal sign-in and select Use another method or the equivalent option when it appears.
- Choose the newly registered method and complete its challenge.
- Confirm that access succeeds and that the method is listed in Security info with a recognizable name.
For an Authenticator registration, verify that a notification arrives on the intended phone and that a one-time code works if your organization exposes that option. For a key or passkey, test the actual device and unlock gesture you will use during an emergency. For SMS or voice, confirm that the code arrives on the correct number and that the phone can receive messages or calls in the place where you normally work.
When should I remove an old authentication method?
Remove it only after the replacement has completed a successful sign-in and you have another fallback. In Security info, select the old entry and use its remove or delete control, if your policy exposes one.
Delete a lost phone promptly once you regain access, because leaving it registered can allow someone who obtains the device to respond to prompts. If removal is unavailable, ask an administrator to remove the method and revoke sessions associated with the lost device. Do not delete every method at once to “start over”; maintain at least one working route while enrolling the replacement.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Which backup is the safest choice?
When the tenant supports them, a FIDO2 security key or passkey is generally preferable for phishing resistance. A physical key is independent of the phone you carry, while a passkey can be convenient when protected by a device PIN or biometric control.
Authenticator is a practical second method because it supports push, codes, passwordless sign-in, and passkeys in one app. SMS or voice can be useful when policy permits, but they should not be treated as equivalent to phishing-resistant credentials. Consider resistance to phishing, independence from the device you might lose, setup effort, portability across devices, tenant-policy support, and whether the method can be tested without disrupting your current login.
For a physical key, check whether your computers support the key’s USB connector or NFC workflow, whether the browser and operating system are compatible, and whether the organization permits that security-key model. Keep a second approved method because a lost key is still a lost credential.
What can a Microsoft Entra administrator do?
Administrators have controls that ordinary users do not. An Authentication Administrator can add or change a user’s methods, reset passwords, require MFA re-registration, revoke sessions, and remove methods. Tenant-wide Authentication methods and Conditional Access policies determine which choices appear and whether self-service enrollment succeeds.
When you contact support, provide the account identifier, explain whether the old phone or key is lost, state whether any other method still works, and identify the replacement method you want to use. The administrator can then apply the organization’s documented recovery process instead of weakening policy for a single sign-in. Ask whether a Temporary Access Pass, managed-device requirement, or supervised enrollment is required.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What are the common failure cases?
| Symptom | Likely cause | Action |
|---|---|---|
| The Add sign-in method control is absent. | Tenant policy or Conditional Access blocks self-service registration. | Ask the administrator which method is permitted and whether they must enroll it for you. |
| The restored Authenticator account immediately asks for setup. | Backup restored the account entry, not a completed work-account trust. | Finish the sign-in and QR-code or prompt-based registration, then test it. |
| You cannot approve a request because the old phone is gone. | No usable method remains on the account. | Use another registered method, or request an administrator reset or Temporary Access Pass. |
| A phone option does not appear. | SMS or voice is disabled for the tenant or for your account. | Choose an exposed method such as Authenticator, passkey, or security key, or ask support about policy. |
| You cannot delete the old method. | The organization controls removal or requires another method first. | Keep the replacement tested and have an administrator remove the retired entry. |
| Authenticator notifications never arrive. | The new phone is offline, notifications are blocked, battery restrictions interfere, or registration was not completed. | Open the app, check connectivity and notification permissions, complete any pending setup, and use a displayed code or another method while troubleshooting. |
| A passkey works on one device but not another. | The credential is device-bound, synchronization is unavailable, or tenant policy restricts the credential manager. | Register a separate passkey on the replacement device and test it. |
What is the safest setup before replacing a phone?
- Register a second method before the phone replacement date.
- Enable Authenticator backup on the old phone if you use Authenticator.
- Confirm that you can reach Security info and know how to select Use another method.
- Register and test the replacement phone while the old phone still works.
- For a FIDO2 key, verify the connector or NFC capability, browser and platform support, and the tenant’s allowed key policy.
- Register a separate passkey if the new phone will not inherit a device-bound credential.
- Record which security key or passkey belongs to the account without storing secret codes in an exposed note.
- Remove the old device only after successful testing, then check that the old entry no longer appears in Security info.
- Know your help-desk or administrator recovery route, including whether Temporary Access Passes are used, before an emergency occurs.
Frequently Asked Questions
Can I register the same phone number for more than one work account?
Whether a number can be reused is determined by the organization’s authentication policy and Microsoft Entra configuration. If the number is rejected, choose an app, passkey, or security key instead of repeatedly retrying enrollment.
Does Authenticator cloud backup transfer every work-account approval automatically?
No. Backup may restore the account entry, but a work or school account can still require a fresh sign-in and device registration. Treat the restored tile as a starting point, not as a completed recovery.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Are two authentication methods legally or technically required for every Microsoft tenant?
No universal Microsoft Entra rule forces every tenant to maintain two methods. Organizations commonly encourage two strong methods because losing one device should not become an account lockout.
Can an administrator recover my account without giving me a permanent password?
Often, yes. The administrator can use the organization’s approved reset process, require MFA re-registration, or issue a Temporary Access Pass when that feature is configured. The exact option depends on tenant policy and administrator permissions.
Is email a backup MFA method for a Microsoft work account?
Usually not. In Microsoft’s administrator workflow, email can be contact information for self-service password reset, but it is not presented as a general MFA approval method. Use the methods shown on Security info.
Will a passkey on my old phone automatically appear on my new phone?
Not necessarily. A device-bound passkey remains on the old device. A synchronized passkey may be available through its credential manager, but tenant policy can restrict synchronization. Register and test a passkey on the new phone before removing the old one.
Can I add a security key if my company has not issued one?
Only if the tenant allows FIDO2 security-key registration and the key is compatible with your platform and browser. Check the organization’s policy and the key’s USB or NFC support before purchasing or enrolling it.
What should I do if I receive an unexpected Authenticator approval request?
Do not approve it. Deny the request, report it through your organization’s security process, and contact the help desk if you suspect that your password or device is compromised. After access is secured, review and remove unknown methods.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The Bottom Line
Use Security info to add a permitted backup method, complete its enrollment, and prove it works with a real sign-in before removing the old device. Authenticator is convenient; FIDO2 keys and passkeys offer stronger phishing resistance when your tenant supports them. If self-service registration or recovery is blocked, your Microsoft 365 or Entra administrator must provide the approved reset or Temporary Access Pass process.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
