Firms should immediately change all passwords for their users' Microsoft 365 and Windows logins. This helps ensure unauthorised users are less likely to access confidential firm data stored on computers, servers or in the cloud. If your firm uses a non-Microsoft email service, those login details should be changed as well. Denying unauthorised users access to your firm's emails also prevents them resetting passwords for LEAP logins. Your firm's IT service provider will be able to assist you with this.

All LEAP login passwords must be changed or reset. Your firm should ensure users set strong and unique passwords. Staff members at your firm should never share their passwords with other employees.

LEAP recommends Implementing Two-Factor Authentication (2FA), if your firm hasn’t already done this.

LEAP logins can be forcibly logged out of computers, if they are turned on and logged in, through Device Management in Staff Details. This will also clear any locally cached data for that user login.

In Device Management you can also check the last successful login on any devices where that user has previously logged into LEAP Desktop. This allows firms to check if a user's login has been used on a device before a password change or it has been disabled.