How to migrate a user's 2FA from Microsoft Authenticator to 1Password?

[FASupportBot]

We need to migrate a user's existing two-factor authentication method from Microsoft Authenticator to 1Password. The user wants to switch authenticator apps but already has an active TOTP method enrolled.

What is the recommended approach for switching between authenticator apps? Should we remove the existing method first, or is there a way to add a second method and then remove the old one?

The documentation mentions several approaches for managing MFA methods, but we're not sure which path is best for this use case of switching authenticator apps.

[FASupportBot]

To migrate a user from Microsoft Authenticator to 1Password (or any other TOTP authenticator app), the recommended approach is to remove the old method first, then have the user re-enroll with the new app.

Step 1: Prompt the user to enroll with 1Password

The user can add a new authenticator method via:

Self-service account management (paid plans):

• User navigates to their account page → Manage two-factor → Add two-factor → Authenticator app
• Scan the new QR code with 1Password, including providing a name
• See: Add Authenticator as a second factor

You can also build your own page using the APIs.

This approach ensures a clean transition between authenticator apps without conflicts or confusion.

Step 2: Remove the existing Microsoft Authenticator method

You have two options:

Option A: Admin UI

• Navigate to Users → [Select User] → Multi-Factor tab
• Click the red trash icon to remove the authenticator method
• An admin role can do this without requiring a one-time code from the user
• An mfa_deleter role can do this, but confirmation from the user is required.
• See: Disable MFA documentation

Option B: User API (programmatically)

• GET the user object
• Remove the authenticator entry from the twoFactor.methods array
• PUT the updated user object back
• This requires no code from the user and is useful for support scenarios (e.g., user lost their device)
• Note: Use PUT rather than PATCH due to how arrays are handled in the API

This approach ensures that the user always has MFA enabled, but requires action on their part.

If you reverse them, but use an MFA policy of Required (or one of the intelligent MFA policies), then users will be forced to re-enroll.

---

Related Documentation

• Multi-Factor Authentication (MFA) Overview
• Disable MFA on a User
• Add Authenticator as a Second Factor
• Self-Service Account Management
• Update a User API
• Disable Multi-Factor API