Multi-Factor Authentication (MFA)

How To

Multi-Factor Authentication (MFA) is mandatory for all clients and users accessing the system.

MFA requires users to verify their identity using two separate forms of authentication before access is granted.

Traditionally, users are familiar to verification systems that require them to provide a unique identifier such as an email address and a password to gain access to the system. MFA extends this model by adding an additional step to the verification process, in our case requiring the user to enter a one-time verification code that is generated via a mobile device that only the user has access to.

You can generate MFA verification codes using the LEAP Authenticator in the LEAP Mobile app.

Alternatively, you can also use a Third Party Authenticator app of your choice, such as Microsoft Authenticator or Google Authenticator.

Overview

Why do I need MFA?

MFA gives the user and administrator a peace of mind as it ensures that even if their password is compromised, the account cannot be accessed without entering a verification code.

How does it work?

When signing into LEAP, you'll first need to enter your LEAP credentials. If the credentials are valid, you'll then be prompted to enter a verification code which is generated via your mobile device.

Do I need to enter a code every time I log into LEAP?

No, if you've trusted a device or browser, you won’t need to enter a code until the device or browser is un-trusted.

Educate your staff about MFA

Make sure everyone understands why you are implementing MFA. We recommend that you share this article with your staff.

Do all staff have a supported device with LEAP Mobile installed?

MFA requires all staff to have the LEAP Mobile app or a Third Party Authenticator app installed on their iPhone, iPad or Android device.

Have a plan for lost devices

Ensure that you know who has administrator privileges in LEAP as only LEAP Admin users can help you regain access to your account if your device is lost or unavailable.

See the tabs below for the Authenticator method you wish to use:

Third Party Authenticator
LEAP Authenticator

Activating Your Device

With MFA being mandatory, the next time you sign into LEAP, you will be prompted to set up MFA.

Desktop

Click Use Third Party Authenticator.

Instructions to scan the QR code using your mobile authentication app of choice will be displayed.
Download an Authenticator app of your choice. For example, Microsoft Authenticator or Google Authenticator.
Scan the QR code using your authenticator app.
Once added, you will see a 6-digit code which you can now use to log into LEAP Desktop.
Back on LEAP Desktop, click Continue.
Enter the MFA code from your third party authenticator and click Pair Device.

Once you enter a valid MFA code, you’ll be logged into LEAP Desktop, and your third-party authenticator will be successfully enabled.

Web

Click Continue with Other Authenticator.

Instructions on how to set up multi-factor authentication with an authenticator app of your choice will be displayed.
Download an Authenticator app of your choice. For example, Microsoft Authenticator or Google Authenticator.
Scan the QR code using your authenticator app, or manually enter the key shown in the instructions on LEAP Web.
Once added, you will see a 6-digit code which you can now use to log into LEAP Web.
Click Next.
Enter the MFA code from your third party authenticator and update the Name if required.
Click Next.

After you enter a valid MFA code, you will receive a message that multi-factor authentication with your third party authenticator has been successfully enabled.

Application Settings

You can also activate a Third Party Authenticator app via the LEAP Application Settings.

Click to edit heading

Desktop: Click the LEAP Menu > Settings > Application Settings.

The LEAP Application Settings will open in a new window.

Web: Click > Settings > Application Settings.

The LEAP Application Settings will open in a new window.

If you do not have permissions to access the LEAP Application Settings, you can still access the Multi-factor authentication settings via Staff Settings to activate your Authenticator app.

To access Staff Settings, click the LEAP Menu > Settings > under Apps > Staff Settings, then proceed from Step 4.

Click Firm > under Staff > Staff Members.

The Staff Members List will be displayed.
Click your name to open your staff profile from the Staff Members List.
Click Multi-factor authentication on the left.
Under Multi-Factor Authenticator Apps, click Enroll next to Other Authenticator.
Enter your LEAP password.
Instructions on how to set up multi-factor authentication with an authenticator app of your choice will be displayed.
Download an Authenticator app of your choice. For example, Microsoft Authenticator or Google Authenticator.
Scan the QR code using your authenticator app, or manually enter the key shown.
Once added, you will see a 6-digit MFA code.
Click Next back in the Staff Members page.
Enter the MFA code from your third party authenticator and update the Name if required.
Click Next.

After you enter a valid MFA code, you will receive a message that multi-factor authentication with your third party authenticator has been successfully enabled.

Signing into LEAP

Desktop

Log into LEAP Desktop with your username and password.
You will be prompted to enter a verification code.
Open your third party authenticator app to generate a code.
Enter the verification code displayed on your authenticator app into LEAP.
(Optional) Select Trust this device if you would like to bypass MFA on your current device for 30 days.

Click to edit heading

Do not choose this option if you’re using a shared computer.

Click Verify.

Click to edit heading

Please note that after six unsuccessful MFA code attempts, your account will be locked for 30 minutes.

Web

Log into LEAP Web with your username and password.
You will be prompted to enter a verification code.
Open your third party authenticator app to generate a code.
Enter the verification code displayed on your authenticator app into LEAP Web.
(Optional) Tick Trust this computer (for 30 days) if you would like to bypass MFA on your current device for 30 days. You can also update the Computer Name if needed.

Click to edit heading

Do not choose this option if you’re using a shared computer.

Click Authenticate.

Click to edit heading

Please note that after six unsuccessful MFA code attempts, your account will be locked for 30 minutes.

Trusted Devices

Trusting Devices & Browsers

Trusting devices can only be done after entering your username and password and during the MFA code challenge screen.

LEAP Desktop

Tick Trust this device before you click on Verify. Your desktop device is now trusted and will remain so until the device is un-trusted.

LEAP Web

Tick the option Trust this computer and update the Computer Name for easier identification, if necessary. The browser will be trusted for 30 days or until the browser history is cleared.

Click to edit heading

Devices can only be trusted for a maximum of 30 days.
Devices cannot be trusted via the Application Settings window.

Removing Trusted Devices

To remove a trusted device:

Click to edit heading

Please note that you can only remove trusted devices from your own account.

Click to edit heading

Desktop: Click the LEAP Menu > Settings > Application Settings.

The LEAP Application Settings will open in a new window.

Web: Click > Settings > Application Settings.

The LEAP Application Settings will open in a new window.

If you do not have permissions to access the LEAP Application Settings, you can still access the Multi-factor authentication settings via Staff Settings to remove trusted devices.

To access Staff Settings, click the LEAP Menu > Settings > under Apps > Staff Settings, then proceed from Step 4.

Click Firm > under Staff > Staff Members.

The Staff Members List will be displayed.
Click your name to open your staff profile from the Staff Members List.
Click Multi-factor authentication on the left.
Under Trusted Devices, click the bin icon next to the device you would like to remove.
Click Delete to continue.

A notification will be displayed to confirm that the trusted device has been removed.

Managing Authenticator Devices & Apps

Replacing Your Authenticator

You can replace your Third Party authenticator app if you wish to switch to a different one. For example, changing from Microsoft Authenticator to Google Authenticator.

Click to edit heading

Desktop: Click the LEAP Menu > Settings > Application Settings.

The LEAP Application Settings will open in a new window.

Web: Click > Settings > Application Settings.

The LEAP Application Settings will open in a new window.

If you do not have permissions to access the LEAP Application Settings, you can still access the Multi-factor authentication settings via Staff Settings to replace your Authenticator app.

To access Staff Settings, click the LEAP Menu > Settings > under Apps > Staff Settings, then proceed from Step 4.

Click Firm > under Staff > Staff Members.

The Staff Members List will be displayed.
Click your name to open your staff profile from the Staff Members List.
Click Multi-factor authentication on the left.
Under Multi-Factor Authenticator Apps, click the 3 dots icon next to Other Authenticator and click Replace authenticator.
Replacing the authenticator will remove the current authenticator and all trusted devices.

Click Continue to confirm.
Enter your LEAP password.
Instructions to replace your authenticator app will be displayed on the screen.

You can now download another Third Party Authenticator app and scan the QR code or manually enter the key to activate it.
Click Continue.
Enter a verification code from the new authenticator app to complete the pairing.

You can also update the Name of the authenticator.
Click Confirm.

Removing Your Authenticator

Click to edit heading

Please note that removing your account from your Third Party Authenticator app will not remove the Authenticator app enrolled in the LEAP Application Settings.

If you no longer have access to your mobile device, you may need to remove the currently enrolled Third Party Authenticator from the LEAP Application Settings before setting it up on a new device.

Some authenticator apps allow accounts and verification codes to sync to your account. If this feature is enabled, you may be able to install the authenticator app on another device and sign in to restore your verification codes.

If you cannot access your synced authenticator account, follow the steps below to remove the authenticator from the LEAP Application Settings:

Click to edit heading

Desktop: Click the LEAP Menu > Settings > Application Settings.

The LEAP Application Settings will open in a new window.

Web: Click > Settings > Application Settings.

The LEAP Application Settings will open in a new window.

If you do not have permissions to access the LEAP Application Settings, you can still access the Multi-factor authentication settings via Staff Settings to remove your Authenticator app.

To access Staff Settings, click the LEAP Menu > Settings > under Apps > Staff Settings, then proceed from Step 4.

Click Firm > under Staff > Staff Members.

The Staff Members List will be displayed.
Click your name to open your staff profile from the Staff Members List.
Click Multi-factor authentication on the left.
Under Multi-Factor Authenticator Apps, click the 3 dots icon next to Other Authenticator and select Remove authenticator.
Removing the authenticator will remove the current authenticator and all trusted devices.

Click Continue to confirm.
Enter your LEAP password.

A notification will be displayed to confirm that the Third Party Authenticator app has been removed.

Click to edit heading

Please note that you will also need to manually remove the account from your Third Party Authenticator app to completely clear it.

Removing All Enrolled Authenticators (Admin Users Only)

Click to edit heading

Please note that the following feature is only available to LEAP Admin users only.

In some cases, your LEAP Admin user may need to remove all of your enrolled authenticators on your behalf.

Click to edit heading

Desktop: Click the LEAP Menu > Settings > Application Settings.

The LEAP Application Settings will open in a new window.

Web: Click > Settings > Application Settings.

The LEAP Application Settings will open in a new window.

Click Firm > under Staff > Staff Members.

The Staff Members List will be displayed.
From the Staff Members list, click the staff member whose authenticators you’d like to remove to open their profile.
Click Multi-factor authentication on the left.
Under Multi-Factor Authenticator Apps, click Remove Authenticators.
Removing all enrolled authenticators will require the staff member to re-enroll their authenticators.

Click Continue to confirm.
Enter your LEAP password.

The staff member will now be prompted to enroll an authenticator the next time they log in to LEAP.

Activating Your Device

Click to edit heading

Please ensure your LEAP Mobile app is updated to the latest version. Only one mobile device per LEAP user can be activated to receive verification codes.

Desktop

Once you log into LEAP Desktop, you will be redirected to the LEAP Mobile app to continue the set up of MFA.

Click to edit heading

If you are currently logged into the LEAP Mobile app, please ensure you log out first before starting the MFA activation process.

Open or download the LEAP Mobile app.
From the LEAP Mobile app home screen, tap the Authenticator icon to switch modes.
Log in with your username and password.
You will be prompted to set your current device as the Authenticator device.

Tap Activate to continue.

A notification will appear confirming that your device has been successfully activated as your LEAP Authenticator.

A 6-digit verification code will then be displayed, which you can use to log in to LEAP.

Web

Once you log into LEAP Web, you will be redirected to the LEAP Mobile app to continue the set up of MFA.

Click Continue with LEAP Authenticator.

Instructions on how to set up multi-factor authentication with the LEAP Authenticator will be displayed.
Open or download the LEAP Mobile app.

Click to edit heading

If you are currently logged into the LEAP Mobile app, please ensure you log out first before starting the MFA activation process.

From the LEAP Mobile app home screen, tap the Authenticator icon to switch modes.
Log in with your username and password.
You will be prompted to set your current device as the Authenticator device.

Click Activate to continue.

A notification will appear confirming that your device has been successfully activated as your LEAP Authenticator.

A 6-digit verification code will then be displayed, which you can use to log in to LEAP.

Mobile (iOS & Android)

Click to edit heading

If you are currently logged into the LEAP Mobile app, please ensure you log out first before starting the MFA activation process.

Open or download the LEAP Mobile app.
From the LEAP Mobile app home screen, tap the Authenticator icon to switch modes.
Log in with your username and password.
You will be prompted to set your current device as the Authenticator device.

Tap Activate to continue.

A notification will appear confirming that your device has been successfully activated as your LEAP Authenticator.

A 6-digit verification code will then be displayed, which you can use to log in to LEAP.

Application Settings

Click to edit heading

Desktop: Click the LEAP Menu > Settings > Application Settings.

The LEAP Application Settings will open in a new window.

Web: Click > Settings > Application Settings.

The LEAP Application Settings will open in a new window.

If you do not have permissions to access the LEAP Application Settings, you can still access the Multi-factor authentication settings via Staff Settings to activate your Authenticator device.

To access Staff Settings, click the LEAP Menu > Settings > under Apps > Staff Settings, then proceed from Step 4.

Click Firm > under Staff > Staff Members.

The Staff Members List will be displayed.
Click your name to open your staff profile from the Staff Members List.
Click Multi-factor authentication on the left.
Under Multi-Factor Authenticator Apps, click Enroll next to LEAP Authenticator.
Enter your LEAP password.
Instructions on how to set up multi-factor authentication with the LEAP Authenticator will be displayed.
Open or download the LEAP Mobile app.

Click to edit heading

If you are currently logged into the LEAP Mobile app, please ensure you log out first before starting the MFA activation process.

From the LEAP Mobile app home screen, tap the Authenticator icon to switch modes.
Log in with your username and password.
You will be prompted to set your current device as the Authenticator device.

Tap Activate to continue.

A notification will appear confirming that your device has been successfully activated as your LEAP Authenticator.
Click Continue back in the Staff Members page.
Enter the MFA code from your LEAP Authenticator and update the Name if required.
Click Next.

After you enter a valid MFA code, you will receive a message that multi-factor authentication with your LEAP Authenticator has been successfully enabled.

Signing into LEAP

Desktop

Log into LEAP Desktop with your username and password.
You will be prompted to enter a MFA verification code.
Open the LEAP Mobile app.
From the LEAP Mobile app home screen, tap Authenticator to switch modes.
Enter your username and password.
Enter the verification code displayed on the LEAP Authenticator.

The verification code will expire in 30 seconds. If you cannot enter the code by then, a new code will be automatically generated for you.
(Optional) Select Trust this device if you would like to bypass MFA on the device you’re currently using.

Click to edit heading

Do not choose this option if you’re using a shared computer.

Click Verify.

Click to edit heading

Please note that after six unsuccessful MFA code attempts, your account will be locked for 30 minutes.

Web

Log into LEAP Web with your username and password.
You will be prompted to enter a MFA verification code.
Open the LEAP Mobile app.
From the LEAP Mobile app home screen, tap Authenticator to switch modes.
Enter your username and password.
Enter the verification code displayed on the LEAP Authenticator.

The verification code will expire in 30 seconds. If you cannot enter the code by then, a new code will be automatically generated for you.
(Optional) Tick Trust this computer (for 30 days) if you would like to bypass MFA on the device you’re currently using. You can also update the Computer Name if needed.

Click to edit heading

Do not choose this option if you’re using a shared computer.

Click Authenticate.

Click to edit heading

Please note that after six unsuccessful MFA code attempts, your account will be locked for 30 minutes.

Trusted Devices

Trusting Devices & Browsers

Trusting devices can only be done after entering your username and password and during the MFA code challenge screen.

LEAP Desktop

Tick Trust this device before you click on Verify. Your desktop device is now trusted and will remain so until the device is un-trusted.

LEAP Web

Tick the option Trust this computer and update the Computer Name for easier identification, if necessary. The browser will be trusted for 30 days or until the browser history is cleared.

Click to edit heading

Devices can only be trusted for a maximum of 30 days.
Devices cannot be trusted via the Application Settings window.

Removing Trusted Devices

To remove a trusted device:

Click to edit heading

Please note that you can only remove trusted devices from your own account.

Click to edit heading

Desktop: Click the LEAP Menu > Settings > Application Settings.

The LEAP Application Settings will open in a new window.

Web: Click > Settings > Application Settings.

The LEAP Application Settings will open in a new window.

If you do not have permissions to access the LEAP Application Settings, you can access the Multi-factor authentication settings via Staff Settings to remove trusted devices.

To access Staff Settings, click the LEAP Menu > Settings > under Apps > Staff Settings, then proceed from Step 4.

Click Firm > under Staff > Staff Members.

The Staff Members List will be displayed.
Click your name to open your staff profile from the Staff Members List.
Click Multi-factor authentication on the left.
Under Trusted Devices, click the bin icon next to the device you would like to remove.
Click Delete to continue.

A notification will be displayed to confirm that the trusted device has been removed.

Managing Authenticator Devices & Apps

Replacing Your Authenticator

Click to edit heading

Desktop: Click the LEAP Menu > Settings > Application Settings.

The LEAP Application Settings will open in a new window.

Web: Click > Settings > Application Settings.

The LEAP Application Settings will open in a new window.

If you do not have permissions to access the LEAP Application Settings, you can still access the Multi-factor authentication settings via Staff Settings to replace your Authenticator device.

To access Staff Settings, click the LEAP Menu > Settings > under Apps > Staff Settings, then proceed from Step 4.

Click Firm > under Staff > Staff Members.

The Staff Members List will be displayed.
Click your name to open your staff profile from the Staff Members List.
Click Multi-factor authentication on the left.
Under Multi-Factor Authenticator Apps, click the 3 dots icon next to LEAP Authenticator and click Replace authenticator.
Replacing the authenticator will remove the current authenticator device and all trusted devices.

Click Continue to confirm.
Enter your LEAP password.
Instructions to replace your LEAP Authenticator will be displayed on the screen.

Open or download the LEAP Mobile app on your new device.

Click to edit heading

If you are currently logged into the LEAP Mobile app, please ensure you log out first before starting the MFA activation process.

Tap Authenticator to switch modes.
Log in with your username and password.
You will be prompted to set your current device as the Authenticator device.

Click Activate to continue.
Click Continue back in the Staff Members page.
Enter the MFA code from the LEAP Authenticator and update the Name if required.
Click Next.

A notification will appear confirming that your new device has been successfully activated as your LEAP Authenticator.

Removing Your Authenticator

Click to edit heading

We highly recommend deactivating the LEAP Authenticator on your mobile device before uninstalling/removing the LEAP Mobile app.

If you did not deactivate the LEAP Authenticator prior to uninstalling/removing the LEAP Mobile app, you can still deactivate it from the LEAP Application Settings.

There may be times when you need to deactivate the LEAP Authenticator on your device, such as when:

You purchase a new mobile device; or
You no longer have access to your mobile device.

If you purchase a new mobile device, you will need to remove the LEAP Authenticator from your old paired device and then activate the LEAP Authenticator on your new mobile device to receive verification codes.

If you no longer have access to your mobile device, you will need to remove the LEAP Authenticator via the Application Settings page and then activate the LEAP Authenticator on your new device.

From Your Paired Device

Click to edit heading

If your LEAP Firm Admin has restricted your access to LEAP Mobile, you will need to log into the Authenticator side of the LEAP Mobile App.

Please see our article, LEAP Mobile Authenticator for more information.

Open the LEAP Mobile app from your paired mobile device.
- iPhone: Tap > under Profile & Security > Multi-Factor Authentication > Disable Use As Authenticator.
- iPad: Tap > under Profile & Security > Multi-Factor Authentication > Disable Use As Authenticator.
- Android: Tap Settings > Multi-Factor Authentication > Disable Use As Authenticator.

From LEAP Application Settings

Click to edit heading

Desktop: Click the LEAP Menu > Settings > Application Settings.

The LEAP Application Settings will open in a new window.

Web: Click > Settings > Application Settings.

The LEAP Application Settings will open in a new window.

If you do not have permissions to access the LEAP Application Settings, you can still access the Multi-factor authentication settings via Staff Settings to remove your Authenticator device.

To access Staff Settings, click the LEAP Menu > Settings > under Apps > Staff Settings, then proceed from Step 4.

Click Firm > under Staff > Staff Members.

The Staff Members List will be displayed.
Click your name to open your staff profile from the Staff Members List.
Click Multi-factor authentication on the left.
Under Multi-Factor Authenticator Apps, click the 3 dots icon next to LEAP Authenticator and select Remove authenticator.
Removing the authenticator will remove the current authenticator device and all trusted devices.

Click Continue to confirm.
Enter your LEAP password.

A notification will be displayed to confirm that the LEAP Authenticator has been removed.

Removing All Enrolled Authenticators (Admin Users Only)

Click to edit heading

Please note that the following feature is only available to LEAP Admin users only.

In some cases, your LEAP Admin user may need to remove all of your enrolled authenticators on your behalf.

Click to edit heading

Desktop: Click the LEAP Menu > Settings > Application Settings.

The LEAP Application Settings will open in a new window.

Web: Click > Settings > Application Settings.

The LEAP Application Settings will open in a new window.

Click Firm > under Staff > Staff Members.

The Staff Members List will be displayed.
From the Staff Members list, click the staff member whose authenticators you’d like to remove to open their profile.
Click Multi-factor authentication on the left.
Under Multi-Factor Authenticator Apps, click Remove Authenticators.
Removing all enrolled authenticators will require the staff member to re-enroll their authenticators.

Click Continue to confirm.
Enter your LEAP password.

The staff member will now be prompted to enroll an authenticator the next time they log in to LEAP.

Pausing Multi-Factor Authentication for 24 Hours

You can temporarily pause Multi-Factor Authentication for 24 hours.

You can temporarily disable Multi-Factor Authentication for your own account. However, only a LEAP Admin user can temporarily disable Multi-Factor Authentication for other staff members.

Click to edit heading

If you’re experiencing issues logging in with MFA, please contact your LEAP Admin user and ask them to temporarily pause MFA for your account using the steps below.

If you are a single user firm and unable to log in with MFA, please contact LEAP Support for assistance.

Click to edit heading

Desktop: Click the LEAP Menu > Settings > Application Settings.

The LEAP Application Settings will open in a new window.

Web: Click > Settings > Application Settings.

The LEAP Application Settings will open in a new window.

If you do not have permissions to access the LEAP Application Settings, you can still access the Multi-factor authentication settings via Staff Settings to pause Multi-Factor Authentication.

To access Staff Settings, click the LEAP Menu > Settings > under Apps > Staff Settings, then proceed from Step 4.

Click Firm > under Staff > Staff Members.

The Staff Members List will be displayed.
Select the staff member.
Click Multi-factor authentication on the left.
Click to toggle the Require MFA option off.
Click Continue.
Enter your LEAP password.

Multi-factor Authentication will be paused for 24 hours, and the time it will automatically resume will be shown.

Click to edit heading

To unpause MFA, toggle Require MFA back on and enter your LEAP password to confirm the change.

Last Modified Date

21/05/2026 11:57 am

Title

Multi-Factor Authentication (MFA)

URL Name

Two-Factor-Authentication-2FA-NZ

Resolution