Replacing Your MFA Phone: A Municipal Staff Checklist

Include account access in the phone change

Imagine a township employee replacing a phone over the weekend. On Monday, an office application asks for verification through the old device, which has already been traded in. The employee knows the password, but the usual sign-in process cannot be completed. A planned phone change should include a short account-access check before the old device leaves the employee's control.

For Michigan township, village, and city staff, begin with the work that depends on that phone: municipal email, an application portal, or an approved remote connection. Tell IT about the replacement in advance and agree on a time to verify access. Include part-time employees whose next office day may be several days away. A missing phone needs prompt reporting through the municipality's established process instead of waiting for a replacement appointment.

Identify the accounts and the support route

List the work services that use the phone for sign-in and have IT confirm how each is managed. Some may use the municipality's main account, while others may have a separate application administrator. Record the service name and support owner. Keep passwords, enrollment codes, and other sign-in secrets out of this planning list. Its purpose is to identify the work and the people responsible for it.

Ask IT which approved alternative methods or recovery arrangements apply to each account. Have the provider explain any differences between services and what staff should do when their usual method is unavailable. Keep the known support number accessible through an approved route that does not depend entirely on the affected mailbox. Agree on the municipal contact who can help coordinate an interruption to time-sensitive work.

Check what an Authenticator restore actually restores

Microsoft's current Authenticator guidance says work or school account credentials are not backed up. Restoring the app brings back the account name, but the user must sign in and register that account again on the new device. Seeing the familiar municipal account listed in the app therefore needs a follow-up check that enrollment and sign-in have been completed.

For a planned replacement, Microsoft advises keeping the old device available until those accounts have been registered on the new one. Coordinate that sequence with IT and any trade-in arrangements. Have the provider explain the process for the actual phone, account, and authentication policy. Other authenticator products and application accounts need their own review; a general phone-transfer message should not be the office's acceptance check.

Verify the new sign-in before the old phone goes

Follow IT's approved enrollment instructions and use the municipality's known service addresses. Arrange a controlled sign-in check for the work accounts identified in the plan. Have IT choose the test so it exercises the new method without unnecessarily closing the employee's only working session. Confirm the account being used, the verification method requested, and whether the employee can complete the intended task.

An application already open on a computer does not demonstrate the replacement phone's verification step. Record which accounts were checked and which still need attention. Approve only prompts associated with the sign-in you are intentionally performing. Microsoft's verification-code guidance warns against responding to codes you did not request. Report an unexpected prompt through the known support route and let IT assess it.

Give a lost-phone recovery request a clear handoff

When the device is missing, tell the established support contact promptly. Explain which device and accounts are involved, when it was last available, and whether it is lost, stolen, damaged, or still in your possession. Give a reachable contact and describe the municipal work that is waiting. Follow the provider's directions for any immediate account or device actions.

Use the municipality's agreed identity-verification process before changing authentication methods. A request arriving from a new phone number or email address needs confirmation through that process. Make sure staff know who can approve and perform recovery, including when the usual contact is away. Keep recovery credentials within the provider's approved delivery method rather than adding them to ordinary comments or shared office notes.

Complete recovery and review the old access

Microsoft documents Temporary Access Pass as a time-limited passcode that can help users register authentication methods and recover when a strong method is unavailable. Its use depends on the configured policy and authorized administrator roles. Ask IT which recovery procedure fits the municipality's environment and how the employee completes enrollment afterward. Keep the existing authentication requirements in the recovery plan.

After the new method works, have IT review obsolete registrations and any account or device follow-up needed for the old phone. Confirm the result for each affected service and record unresolved work with an owner. For a planned replacement, tie release of the old device to the agreed handling process. Give the employee a short completion note identifying what was verified and whom to contact if another application still requests the old method.

Use this checklist for the next phone change

Review one employee's planned replacement with IT. Use an approved test account if you are rehearsing a recovery procedure rather than making a real change.

• Identify the work services, account owners, and known support contact.
• Confirm the approved enrollment and recovery arrangements for each service.
• Understand what the authenticator's backup and restore process includes.
• Verify sign-ins using the new device before releasing the old one when possible.
• Report a missing phone promptly and follow the identity-verification process.
• Confirm obsolete-method review, remaining issues, and completion with IT.