okta verify migration to a new phone without the old device

TL;DR

The user cant self-serve without the old device, so an Okta admin removes the old Okta Verify enrollment and the user enrolls the new phone fresh. Verify the caller's identity first through your normal process, since MFA resets are a prime social-engineering target. Then in Okta Admin go to Directory > People > the user > Security Methods, delete the old Okta Verify enrollment, and have the user sign in and scan the QR code on the new phone.

Steps

1. Verify the caller's identity before touching anything. Expected: two verification factors per your helpdesk policy (employee ID plus a manager confirmation or HR record check). Skipping this is how account takeovers happen.
2. In Okta Admin go to Directory > People, find the user, and open Security Methods. Expected: the old phone's Okta Verify enrollment is listed.
3. Delete the Okta Verify enrollment. Keep any other factors in place; if SMS is enrolled it keeps the user working meanwhile. Expected: the factor disappears from the list.
4. Ask the user to sign in at the Okta dashboard. They will be prompted to set up MFA. Expected: a QR code appears on screen.
5. On the new phone, install Okta Verify and scan the QR code. Expected: the account appears in the app and a test push arrives within seconds. Have them tap Approve to confirm the loop works end to end.

Use this when

• The old phone is lost, stolen, wiped, or broken and Okta Verify was the only factor
• The user has a new phone and the old enrollment is still bound to the old device
• Pushes keep going to the old device and the user cant reach them

Not for this skill when

• The old phone still works: use Okta Verify's in-app account transfer instead
• The user only needs a re-enrollment on the same phone (push delivery issue instead)
• You cannot verify the caller's identity: escalate, do not reset

Compatibility

• Okta Identity Engine, Okta Verify 9.x on iOS and Android
• Requires an Okta admin role with user lifecycle permissions

Variants

The user has no other factor and cant sign in to re-enroll

Use the admin "Reset authenticators" action instead of manual deletion. Okta prompts for re-enrollment on the next sign-in.

Temporary access needed while waiting

Issue a one-time bypass code in the admin console if your policy allows it, time-boxed and logged.

Why it happens

Okta Verify enrollments are cryptographically bound to the physical device. Without the old device the enrollment cannot be exported or transferred, so the only path is admin removal plus a fresh enrollment on the new phone.

Edge cases

• MDM that pushes Okta Verify: the app may auto-install, but enrollment still needs the QR scan.
• Users with Okta Verify on a personal and a work phone: remove only the dead enrollment, leave the working one alone.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_7-myNMaBWRJwsq1LtCjbKg