🔐 Self-Service: Change / Replace Your 2FA (MFA) Device

Microsoft 365 & Duo Security

🎯 Purpose
<WRAP info> 🟢 This guide explains **how to change or add a new MFA (2FA) device BEFORE you replace your phone**. Following these steps **prevents account lockouts**. </WRAP>
⚠️ IMPORTANT – DO THIS FIRST
<WRAP danger> 🔴 **Do NOT wipe, reset, or replace your phone before completing this guide.** If you lose access to your MFA device **without adding a new one**, you **WILL be locked out** and require IT intervention. </WRAP>
🔑 Systems Covered

This guide applies to MFA used for:

Microsoft 365

Duo Security (VPN, RDS, Windows logon, remote access)

✅ What You Need Before You Start

Your old phone (still working)

Your new phone (powered on, internet access)

Ability to log in to Microsoft 365 and Duo

Both phones available at the same time

🟦 PART 1: Microsoft 365 – Change MFA Device
Step 1: Sign in to Microsoft Security Info

Open a browser

Go to:
👉 https://mysignins.microsoft.com/security-info

Sign in with your Microsoft 365 email & password

Approve MFA on your old device

Step 2: Add Your New Phone (Recommended)
<WRAP tip> 🟢 **Always ADD the new device first before removing the old one** </WRAP>

Click ➕ Add sign-in method

Select Authenticator app

Install Microsoft Authenticator on your new phone (if not already installed)

Follow the on-screen steps to:

Scan the QR code

Approve the test sign-in

Step 3: Verify New Device Works

Confirm the new device appears under Security info

Ensure it shows Default sign-in method (if applicable)

Perform a test login if prompted

Step 4: Remove Old Phone (Only After Success)
<WRAP warning> ⚠️ Remove the old device **ONLY once the new one is working** </WRAP>

Select your old phone

Click Delete

Confirm removal

🟦 PART 2: Duo Security – Change MFA Device
Step 1: Open Duo Device Management

Go to:
👉 https://portal.duosecurity.com

Log in using your normal credentials

Approve MFA using your existing Duo device

Step 2: Add a New Device

Click Add a new device

Select Mobile phone

Enter your new phone number

Install Duo Mobile on your new phone

Scan the QR code shown on screen

Step 3: Confirm Duo Push Works

Send a Duo Push

Approve it on the new phone

Confirm successful authentication

Step 4: Remove Old Duo Device

Select the old device

Choose Remove or Delete

Confirm removal

🧪 Final Checks (VERY IMPORTANT)
<WRAP important> ✅ Confirm BOTH systems work before wiping your old phone </WRAP>

Test the following:

Microsoft 365 login (Outlook / Web / Teams)

VPN login (if applicable)

RDS / Remote Access

Any system protected by Duo

❌ What NOT To Do
<WRAP danger> ❌ Do not reset your phone before adding a new MFA device ❌ Do not assume MFA will “move automatically” ❌ Do not remove your old device first ❌ Do not delay this until after the phone replacement </WRAP>
🆘 Locked Out?

If you are already locked out:

<WRAP warning> 📧 Contact IT Support  📩 Email: **help@mmc24.com** </WRAP>

Account recovery requires identity verification and manual MFA reset.

📌 Summary

✔ Add new device first

✔ Verify MFA works

✔ Remove old device last

✔ Test all services

Following this process ensures zero downtime and no lockouts 🔐