Two-factor authentication (2FA) in Leapsome

How do I set up two-factor authentication in Leapsome?

Admins can require two-factor authentication (2FA) for the whole company in Settings > Company > Basic settings > 'Account security'. Employees can also turn it on for their own account in 'Personal Settings'. No identity provider is needed.

2FA adds a second step when people sign in to Leapsome with an email and password or with Google. This article explains how admins require 2FA for the company, how employees set it up for their own account, how signing in works and how to reset 2FA for a user.

Table of Contents

• Requiring two-factor authentication for your company
• Setting up two-factor authentication for your own account
• Signing in with two-factor authentication
• Resetting two-factor authentication for a user
• FAQ

Requiring two-factor authentication for your company

Admins can require 2FA for everyone in the company:

1. Go to Settings > Company > Basic settings.
2. Expand 'Account security'.
3. Tick 'Require two-factor authentication'.
4. Optional: tick 'Also apply to single sign-on'.
5. Under 'Allowed methods', choose the methods people can use.
6. Click 'Save changes' and confirm in the dialog.

What happens once 2FA is required

• People without 2FA: set up a second factor at their next sign-in.
• People signed in without 2FA: are signed out and need to sign in again. This includes your own session.
• People whose method is no longer allowed: set up one of the allowed methods.

Setting up two-factor authentication for your own account

Employees can set up 2FA even if the company doesn't require it:

1. Click your name in the top right and select 'Personal Settings'.
2. Under 'Two-factor authentication', click 'Enable two-factor authentication' and choose a method.
3. Enter your password under 'Confirm with your current password' and click 'Continue'.
4. Follow the steps for your method and enter the code.
5. Save your 10 recovery codes, tick the confirmation box and click 'Done'.

Available methods

• Authenticator app (recommended): use an app like Google Authenticator, Microsoft Authenticator or 1Password to generate codes.
• Email: receive a code at the email address of your account.

Managing your methods

In the same section of 'Personal Settings', you can add a second method, remove a method or generate new recovery codes. If your company requires 2FA, you can't remove your last method.

Signing in with two-factor authentication

After you enter your password, Leapsome asks you to confirm it's you:

• Authenticator app: enter the code from your app.
• Email: click 'Send code' and enter the code from your inbox. You can request a new code after 30 seconds.
• Recovery code: click 'Use a recovery code' if you don't have access to your method. Each recovery code works once.

Resetting two-factor authentication for a user

If someone loses access to their method, an admin can reset their 2FA:

1. Open the person's profile.
2. Click the three dots next to 'Upload document'.
3. Select 'Reset two-factor authentication' and confirm.

The reset removes the person's methods and signs them out on every device. They set up 2FA again at their next sign-in.

FAQ

• Do we need an identity provider to use 2FA?
  No. 2FA is built into Leapsome for sign-ins with an email and password or with Google.
• Does 2FA apply to sign-ins through single sign-on?
  Only if you tick 'Also apply to single sign-on'. Otherwise, your identity provider protects these sign-ins.
• What if I lose my phone?
  Sign in with one of your recovery codes, or ask an admin to reset your 2FA.
• What happens if I enter the wrong code too many times?
  After 5 wrong codes, you need to sign in again. Repeated wrong codes or passwords can temporarily lock your account.
• Can an admin reset 2FA for a Super Admin?
  No. Only Super Admins can reset 2FA for a Super Admin.