Mihai N. (Okta, Inc.) asked a question.
Okta Verify Device Transfers
Users replacing phones and getting locked out (requiring factor resets).
- Mihai N. (Okta, Inc.)
When switching to a new phone, Okta Verify does not automatically transfer your account from an iCloud or Google Drive backup because the security token is permanently bound to the physical hardware of the original device.
How you regain access depends entirely on whether you still have your old device or a backup authentication method:
Method 1: Bluetooth Transfer (You still have the old phone)
If your old phone is still functional and you have not wiped it yet, you can securely migrate your credential directly to the new phone.
1.Prepare Both Devices:
Prerequisite.
Turn on Bluetooth on both your old phone and your new phone. Download and install the Okta Verify app from the app store on the new phone.
Verification: The Bluetooth icon is active on both devices.
2.Initiate the Transfer:
Open Okta Verify on the new device and tap Add Account. Choose the option to Transfer from another device.
Verification: The new phone begins searching for nearby Bluetooth signals.
3.Complete the Pairing:
Follow the on-screen Bluetooth pairing prompts to link the two phones and authorize the transfer from the old device.
Verification: The new phone's Okta Verify app displays your 6-digit code or organization name, confirming the credential has successfully moved over.
Method 2: Dashboard Self-Service (Old phone is gone)
If you already traded in, lost, or wiped your old phone, you must rely on a backup authentication method (like SMS, Voice, or a YubiKey) to log in and register the new hardware.
1.Log in using a Backup Factor:
Navigate to your company's Okta login page on a computer. When prompted for Okta Verify, click the arrow or link that says Verify with something else (or Select another factor). Choose SMS, Voice call, or your Security Question to authenticate.
Verification: You successfully reach your Okta End-User Dashboard homepage.
2.Remove the Old Device:
Click your name in the top right corner and select Settings (or My Settings). Scroll down to the Extra Verification or Security Methods section. Locate Okta Verify and click Remove.
Verification: The old Okta Verify entry disappears from your list of enrolled authenticators.
3.Enroll the New Device:
Click Set up next to Okta Verify. Open the newly installed Okta Verify app on your phone, tap Add Account, and scan the QR code displayed on your computer screen.
Verification: Both the computer screen and your phone display a green success message confirming the enrollment.
Method 3: IT Helpdesk Intervention (Total Lockout)
If your old phone is gone and you never registered a backup authentication method (like your personal phone number for SMS), your account is now in a total lockout state.
Because Okta prevents unauthorized device enrollments, only an IT administrator at your company can reset your Okta Verify requirements. You must contact your internal IT Help Desk and request an "MFA Reset for Okta Verify." Once they clear the old device from the backend, you will be prompted to scan a new QR code the next time you log in.
Expand Post
When switching to a new phone, Okta Verify does not automatically transfer your account from an iCloud or Google Drive backup because the security token is permanently bound to the physical hardware of the original device.
How you regain access depends entirely on whether you still have your old device or a backup authentication method:
Method 1: Bluetooth Transfer (You still have the old phone)
If your old phone is still functional and you have not wiped it yet, you can securely migrate your credential directly to the new phone.
1.Prepare Both Devices:
Prerequisite.
Turn on Bluetooth on both your old phone and your new phone. Download and install the Okta Verify app from the app store on the new phone.
Verification: The Bluetooth icon is active on both devices.
2.Initiate the Transfer:
Open Okta Verify on the new device and tap Add Account. Choose the option to Transfer from another device.
Verification: The new phone begins searching for nearby Bluetooth signals.
3.Complete the Pairing:
Follow the on-screen Bluetooth pairing prompts to link the two phones and authorize the transfer from the old device.
Verification: The new phone's Okta Verify app displays your 6-digit code or organization name, confirming the credential has successfully moved over.
Method 2: Dashboard Self-Service (Old phone is gone)
If you already traded in, lost, or wiped your old phone, you must rely on a backup authentication method (like SMS, Voice, or a YubiKey) to log in and register the new hardware.
1.Log in using a Backup Factor:
Navigate to your company's Okta login page on a computer. When prompted for Okta Verify, click the arrow or link that says Verify with something else (or Select another factor). Choose SMS, Voice call, or your Security Question to authenticate.
Verification: You successfully reach your Okta End-User Dashboard homepage.
2.Remove the Old Device:
Click your name in the top right corner and select Settings (or My Settings). Scroll down to the Extra Verification or Security Methods section. Locate Okta Verify and click Remove.
Verification: The old Okta Verify entry disappears from your list of enrolled authenticators.
3.Enroll the New Device:
Click Set up next to Okta Verify. Open the newly installed Okta Verify app on your phone, tap Add Account, and scan the QR code displayed on your computer screen.
Verification: Both the computer screen and your phone display a green success message confirming the enrollment.
Method 3: IT Helpdesk Intervention (Total Lockout)
If your old phone is gone and you never registered a backup authentication method (like your personal phone number for SMS), your account is now in a total lockout state.
Because Okta prevents unauthorized device enrollments, only an IT administrator at your company can reset your Okta Verify requirements. You must contact your internal IT Help Desk and request an "MFA Reset for Okta Verify." Once they clear the old device from the backend, you will be prompted to scan a new QR code the next time you log in.