Multi-factor authentication (MFA) improves on username/password authentication by requiring the user to have a second proof of identity, traditionally “something you have” as well as “something you know.” In the Microsoft ecosystem MFA is typically implemented using an app called Microsoft Authenticator which generates one-time passwords (codes), used in addition to a password to sign in, or passwordless authentication where a request is sent to the authenticator app. The user enters a number displayed by the service they are signing into.

What happens though if you lose or replace your phone (iPhone or Android) that has the authenticator app on it? Microsoft has a post explaining how to restore account credentials from Microsoft Authenticator. The instructions differ for iOS and Android. They work for any codes you have set up in Authenticator for third-party accounts where you have configured MFA with the app.

One should pay attention though to the paragraph entitled: what account information is restored in Authenticator. In particular, for Microsoft personal accounts:

If the account also provides passwordless sign-in, then only the account name is backed up. When you restore, you will need to sign in again.

and for Work or school accounts, also known as Entra ID:

Only the account name is restored. When you restore, you will need to sign in again.

What does it mean, “you will need to sign in again?” How will you do this if you have lost access to the Authenticator which you backed up and restored?

The answer depends on whether any other authentication methods have been set up for the account. When the authenticator method fails, you can tap “Sign in another way” or “I can’t use my Microsoft Authenticator app right now”. If you have a phone number set up, it can send a code there instead (often by WhatsApp rather than SMS).

If you don’t have another authentication method set up, you cannot sign in. Contact your administrator.

You are the administrator? If you are the only global administrator for the Entra ID tenancy, you will have to call Microsoft’s Data Protection helpline and hope that you can prove your identity sufficiently that you can sign back in.

See here for an official response to this problem:

Therefore, if you are the only administrator in your organization, then you need to involve Microsoft data protection team. Please try to find the related hotline number to call the frontline let them raise a ticket for you: Customer service phone numbers – Microsoft Support 

It seems odd to me that Microsoft provides the ability to backup and restore all the Authenticator accounts except the ones it provides itself. And that when users register for MFA they are not able to to get recovery codes for that account.