Lost Phone, Locked Out: A Business Guide to 2FA Recovery, Backup Codes and Safe Resets

When an employee loses the phone that holds their two-factor authentication (2FA), or simply buys a new one, they should be back to work within the hour, and an attacker pretending to be that employee should get nowhere. You get both by preparing in advance: every user registers at least two sign-in methods, backup codes are stored safely, the help desk follows a written identity check before any reset, Microsoft 365 admins use a short-lived Temporary Access Pass to re-enroll the user, Google Workspace admins issue a single backup verification code, and the business keeps emergency access accounts so an admin lockout never becomes a company lockout.

This guide assumes MFA is already on. If it is not, start with our MFA guide for businesses.

Why recovery is a security problem, not just a support ticket

The "I lost my phone, please reset my MFA" call is exactly what attackers imitate. CISA's advisory on the Scattered Spider group (first published in November 2023 and updated in July 2025) describes actors who "posed as employees to convince IT and/or helpdesk staff" to provide information, and who made calls to convince help desk personnel "to reset passwords and/or transfer MFA tokens." The same advisory lists SIM swapping, where criminals convince a mobile carrier to move a victim's phone number to their own SIM card.

So a good recovery process has two goals that pull in opposite directions: fast for the real employee, slow for everyone else. The way to reconcile them is to do the slow part (setup and verification rules) ahead of time.

Before anything is lost: set up for easy recovery

Register more than one method

A single phone is a single point of failure. Ask every user to register at least two methods, for example:

• Microsoft Authenticator or Google prompts on their work phone, plus
• A hardware security key or passkey, or a code-generating authenticator on a second device.

In Microsoft 365, users manage their methods at the Security info page (mysignins.microsoft.com/security-info). In Google Workspace, users manage them under 2-Step Verification in their Google Account. Text messages to a phone number can stay as a last resort, but because of SIM swapping they should not be anyone's only backup.

Store backup codes properly

Google lets each user generate a set of 10 backup codes. Each code works once, and generating a new set makes the old set inactive. Good storage options:

• In the company password manager, in the user's private vault (see our password manager rollout guide).
• Printed and kept in a locked drawer or safe, never taped to the monitor or saved as a photo on the same phone.

Microsoft Entra ID does not use printable backup codes the same way, which is why a second registered method matters even more for Microsoft 365 users.

Keep phones managed

A lost phone is also a lost device with company email on it. If phones are enrolled in Microsoft Intune, you can remove company data from a lost or replaced phone without touching personal photos. Our Intune BYOD guide explains how.

The help desk identity check

Write down how your help desk (internal or outsourced) confirms who is calling before resetting any MFA method. A practical standard for a small business:

1. Call back on a number you already have. Use the phone number in your HR or payroll records, never the number the caller gives you.
2. Get a second confirmation. Ask the person's manager to confirm by a separate channel, such as a Teams message or a call.
3. See them. For remote staff, a live video call with the camera on, comparing the person to the photo ID on file. For on-site staff, walk over or have them come to the office.
4. Never reset based on email alone, especially from a personal address.
5. Slow down for admins and finance. Resets for administrators or people who approve payments need two people on your side to sign off.
6. Log every reset with who asked, how they were verified and who approved it.

If a caller pushes back, claims it is urgent, or name-drops the owner, that is a reason to slow down, not speed up.

Microsoft 365: resetting with a Temporary Access Pass

Microsoft's Temporary Access Pass (TAP) is a time-limited passcode that an admin creates for a user. Microsoft describes it as a way to register new methods and says it "makes recovery easier when a user loses or forgets a strong authentication method."

Configure the TAP policy once

In the Microsoft Entra admin center, under Entra ID > Authentication methods > Policies > Temporary Access Pass, an Authentication Policy Administrator can enable TAP for selected users or groups. Microsoft's defaults are:

Setting	Default	Our suggestion
Default lifetime	1 hour	Keep it short
Maximum lifetime	8 hours	Lower if your team re-enrolls quickly
One-time use	False	Consider True for recovery
Length	8 characters	Default is fine

Note Microsoft's caveat: with a one-time TAP, the user must finish registering a new passwordless method within 10 minutes. TAP also does not work with the NPS extension or the AD FS adapter.

When a phone is lost

1. Verify identity using your written process above.
2. Revoke the user's sessions and, if the phone may be in someone else's hands, reset the password.
3. Remove the old method tied to the lost phone from the user's authentication methods.
4. As an Authentication Administrator (or Privileged Authentication Administrator for admin accounts), add a Temporary Access Pass under the user's Authentication methods. Copy the code; Microsoft only shows it once.
5. Give the code to the user over the verified channel (in person or on the verified call), not by email.
6. The user signs in at Security info with the TAP and registers Authenticator on the new phone, plus a second method.
7. Delete the TAP if it is still valid, and wipe company data from the lost phone in Intune.

Google Workspace: admin-issued backup codes

If a user has no backup codes, an admin with the User management privilege can generate one: in the Admin console go to Directory > Users, select the user, then Security > 2-step verification > Get backup verification codes. Google's help page suggests sending the code by IM or text; we recommend handing it over only through the channel you used to verify the person. The user signs in with their password and that code, then enrolls the new phone and generates a fresh set of backup codes.

One limitation: if 2-Step Verification is enforced in Only security key mode, users cannot generate their own backup codes, and admin-generated codes are accepted only during the enrollment grace period. Keep a spare security key on hand for those users.

Don't lock yourself out: emergency access accounts

The worst version of this problem is the only admin losing their phone. Microsoft recommends two or more emergency access ("break-glass") accounts:

• Cloud-only accounts on the .onmicrosoft.com domain, not synced from on-premises.
• Phishing-resistant sign-in, preferably FIDO2 passkeys (security keys), using a different method from your everyday admin accounts.
• Not tied to any one person's phone.
• Excluded from Conditional Access policies that block or restrict sign-in.
• Credentials stored in secure, fireproof safes in separate locations.
• Alerts on every sign-in, and a test at least every 90 days.

For Google Workspace, Google recommends setting up an additional super administrator, having admins enroll more than one security key, and having super admins generate and print backup codes for other admins ahead of time.

For South Florida businesses, also think about hurricane season: if the keys live in one office safe, make sure a second copy lives somewhere that will not be closed by the same storm (see our hurricane IT checklist).

A 2FA checklist for onboarding and offboarding

Onboarding

• Issue a one-time TAP or temporary code, delivered in person or on a verified call.
• Register two methods on day one; for admins, one must be a security key or passkey.
• Generate and store backup codes (Google Workspace).
• Enroll the work phone in Intune.

Device change

• Register the new phone before wiping the old one when possible.
• Remove the old phone's method afterward.

Offboarding

• Disable the account, revoke sessions and remove all MFA methods.
• Collect security keys and company phones.
• If the person had access to break-glass credentials, change safe combinations and rotate those credentials.

Our onboarding and offboarding IT checklist covers the rest of the account lifecycle.

If you would like us to write your reset procedure, set up Temporary Access Pass and break-glass accounts, or take over these requests as your help desk, our managed IT support team serves businesses across Miami-Dade and South Florida in English and Spanish. Request a free IT assessment to get started.

Sources

• Configure a Temporary Access Pass in Microsoft Entra ID (Microsoft Learn)
• Manage emergency access admin accounts (Microsoft Learn)
• Recover an account protected by 2-Step Verification (Google Workspace Admin Help)
• Sign in with backup codes (Google Account Help)
• Scattered Spider, advisory AA23-320A (CISA)