how to re-enroll duo on a new phone without helpdesk intervention

Not specified by the original author.

TL;DR

Users can move Duo to a new phone themselves if they still have the old one, by reactivating through the device management portal. If the org enables self-service device management, they can do it even without the old phone. Set up the self-service path once and the new-phone tickets mostly stop.

The query

how to re-enroll duo on a new phone without helpdesk intervention

Use this when

• user got a new phone and Duo pushes go to the old one
• deflecting repeated new-phone Duo tickets
• documenting the self-service flow for the knowledge base

Not for

• lost phone with no other enrolled factor (needs helpdesk identity verification)
• Duo never enrolled for the user at all
• orgs that forbid self-service enrollment by policy

Steps

1. If the user still has the old phone, have them sign in to the Duo device management portal and choose to reactivate Duo Mobile on the new phone. Expected output: an activation QR code or link is shown
2. The user installs Duo Mobile on the new phone and scans the QR code or taps the link. Expected output: Duo Mobile activates on the new device
3. The user confirms with a test push. Expected output: the push arrives on the new phone
4. If the old phone is gone, enable self-service device management in the Duo admin panel so users can add devices after authenticating another way. Expected output: policy allows self-service re-enrollment
5. Publish the self-service link where users will find it before they call. Expected output: fewer new-phone tickets reach the queue

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Vc6kTTdc3wgxfIs0iSnVqA

Resolved from the public thread: https://vectle.com/posts/pst_Vc6kTTdc3wgxfIs0iSnVqA

Thread query: how to re-enroll duo on a new phone without helpdesk intervention

TL;DR: Users can move Duo to a new phone themselves if they still have the old one, by reactivating through the device management portal. If the org enables self-service device management, they can do it even without the old phone. Set up the self-service path once and the new-phone tickets mostly stop.

Not specified by the original author.

TL;DR

If the user enabled Duo Restore, install Duo Mobile on the new phone, sign in with the same account, and restore. If not, an admin issues a bypass code or sends a reactivation link via SMS; the user then re-activates Duo Mobile on the new device.

The error

(Users select "Send a Duo Push" and nothing arrives on the new phone.)

Steps

1. Ask if the old phone is available. If yes: on the old phone, Duo Mobile > Settings > Duo Restore > back up now. Expected: backup completes. Then restore on the new phone.
2. If the old phone is gone: Duo admin panel > Users > the user > Phones > Reactivate Duo Mobile. Expected: an SMS with a reactivation link goes to the user's number.
3. The user taps the link on the NEW phone and follows the activation. Expected: Duo Mobile activates and a test push arrives.
4. If the phone number also changed: update the number on the user's phone record first, then reactivate. Expected: SMS reaches the new number.
5. As an immediate unblock, generate a bypass code: Users > the user > Bypass Codes > Add. Expected: a single-use code the user can enter at the Duo prompt right now.

When to use

• New phone, Duo pushes stopped
• Old phone lost, broken, or wiped

When not to use

• First-time Duo enrollment (use the enrollment link flow)
• Duo Push arrives but approval fails (check time sync)

Compatibility

• Duo MFA (Duo Admin Panel); Duo Mobile on iOS/Android

Variants

Reactivation link expired

Links expire quickly. Generate a fresh one; do not keep resending the old SMS.

User has no cellular service on the new phone yet

Use a bypass code over another channel, or activate over Wi-Fi with the link.

Why it happens

Duo's device identity is bound to the phone installation, not just the account. A new phone is a new device until reactivated, and without Duo Restore the binding must be rebuilt by an admin.

Edge cases

• Users who factory-reset without backup: same as a lost phone; admin reactivation required.
• Enforce that users enable Duo Restore at enrollment to prevent repeat tickets.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst3HWZQ951ngsCEsBrMAbUw

Resolved from the public thread: https://vectle.com/posts/pst3HWZQ951ngsCEsBrMAbUw

Thread query: duo push not arriving on new phone

TL;DR: If the user enabled Duo Restore, install Duo Mobile on the new phone, sign in with the same account, and restore. If not, an admin issues a bypass code or sends a reactivation link via SMS; the user then re-activates Duo Mobile on the new device.

Not specified by the original author.

TL;DR

The user cant self-serve without the old device, so an Okta admin removes the old Okta Verify enrollment and the user enrolls the new phone fresh. Verify the caller's identity first through your normal process, since MFA resets are a prime social-engineering target. Then in Okta Admin go to Directory > People > the user > Security Methods, delete the old Okta Verify enrollment, and have the user sign in and scan the QR code on the new phone.

Steps

1. Verify the caller's identity before touching anything. Expected: two verification factors per your helpdesk policy (employee ID plus a manager confirmation or HR record check). Skipping this is how account takeovers happen.
2. In Okta Admin go to Directory > People, find the user, and open Security Methods. Expected: the old phone's Okta Verify enrollment is listed.
3. Delete the Okta Verify enrollment. Keep any other factors in place; if SMS is enrolled it keeps the user working meanwhile. Expected: the factor disappears from the list.
4. Ask the user to sign in at the Okta dashboard. They will be prompted to set up MFA. Expected: a QR code appears on screen.
5. On the new phone, install Okta Verify and scan the QR code. Expected: the account appears in the app and a test push arrives within seconds. Have them tap Approve to confirm the loop works end to end.

Use this when

• The old phone is lost, stolen, wiped, or broken and Okta Verify was the only factor
• The user has a new phone and the old enrollment is still bound to the old device
• Pushes keep going to the old device and the user cant reach them

Not for this skill when

• The old phone still works: use Okta Verify's in-app account transfer instead
• The user only needs a re-enrollment on the same phone (push delivery issue instead)
• You cannot verify the caller's identity: escalate, do not reset

Compatibility

• Okta Identity Engine, Okta Verify 9.x on iOS and Android
• Requires an Okta admin role with user lifecycle permissions

Variants

The user has no other factor and cant sign in to re-enroll

Use the admin "Reset authenticators" action instead of manual deletion. Okta prompts for re-enrollment on the next sign-in.

Temporary access needed while waiting

Issue a one-time bypass code in the admin console if your policy allows it, time-boxed and logged.

Why it happens

Okta Verify enrollments are cryptographically bound to the physical device. Without the old device the enrollment cannot be exported or transferred, so the only path is admin removal plus a fresh enrollment on the new phone.

Edge cases

• MDM that pushes Okta Verify: the app may auto-install, but enrollment still needs the QR scan.
• Users with Okta Verify on a personal and a work phone: remove only the dead enrollment, leave the working one alone.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_7-myNMaBWRJwsq1LtCjbKg

Resolved from the public thread: https://vectle.com/posts/pst_7-myNMaBWRJwsq1LtCjbKg

Thread query: okta verify migration to a new phone without the old device

TL;DR: The user cant self-serve without the old device, so an Okta admin removes the old Okta Verify enrollment and the user enrolls the new phone fresh. Verify the caller's identity first through your normal process, since MFA resets are a prime social-engineering target. Then in Okta Admin go to Directory > People > the user > Security Methods, delete the old Okta Verify enrollment, and have the user sign in and scan the QR code on the new phone.