Multi-Factor Authentication (MFA)

How To

Multi-Factor Authentication (MFA) is mandatory for all clients and users accessing the system.

MFA requires users to verify their identity using two separate forms of authentication before access is granted.

Traditionally, users are familiar to verification systems that require them to provide a unique identifier such as an email address and a password to gain access to the system. MFA extends this model by adding an additional step to the verification process, in our case requiring the user to enter a one-time verification code that is generated via a mobile device that only the user has access to.

You can generate MFA verification codes using the LEAP Authenticator in the LEAP Mobile app.

Alternatively, you can also use a Third Party Authenticator app of your choice, such as Microsoft Authenticator or Google Authenticator.

Overview

Why do I need MFA?

MFA gives the user and administrator a peace of mind as it ensures that even if their password is compromised, the account cannot be accessed without entering a verification code.

How does it work?

When signing into LEAP, you'll first need to enter your LEAP credentials. If the credentials are valid, you'll then be prompted to enter a verification code which is generated via your mobile device.

Do I need to enter a code every time I log into LEAP?

No, if you've trusted a device or browser, you won’t need to enter a code until the device or browser is un-trusted.

Educate your staff about MFA

Make sure everyone understands why you are implementing MFA. We recommend that you share this article with your staff.

Do all staff have a supported device with LEAP Mobile installed?

MFA requires all staff to have the LEAP Mobile app or a Third Party Authenticator app installed on their iPhone, iPad or Android device.

Have a plan for lost devices

Ensure that you know who has administrator privileges in LEAP as only LEAP Admin users can help you regain access to your account if your device is lost or unavailable.

See the tabs below for the Authenticator method you wish to use:

Third Party Authenticator
LEAP Authenticator
Email MFA Option

Activating Your Device

With MFA being mandatory, the next time you sign into LEAP, you will be prompted to set up MFA.

Desktop

Click Use Third Party Authenticator.

Instructions to scan the QR code using your mobile authentication app of choice will be displayed.
Download an Authenticator app of your choice. For example, Microsoft Authenticator or Google Authenticator.
Scan the QR code using your authenticator app.
Once added, you will see a 6-digit code which you can now use to log into LEAP Desktop.
Back on LEAP Desktop, click Continue.
Enter the MFA code from your third party authenticator and click Pair Device.

Once you enter a valid MFA code, you’ll be logged into LEAP Desktop, and your third-party authenticator will be successfully enabled.

Web

Click Continue with Other Authenticator.

Instructions on how to set up multi-factor authentication with an authenticator app of your choice will be displayed.
Download an Authenticator app of your choice. For example, Microsoft Authenticator or Google Authenticator.
Scan the QR code using your authenticator app, or manually enter the key shown in the instructions on LEAP Web.
Once added, you will see a 6-digit code which you can now use to log into LEAP Web.
Click Next.
Enter the MFA code from your third party authenticator and update the Name if required.
Click Next.

After you enter a valid MFA code, you will receive a message that multi-factor authentication with your third party authenticator has been successfully enabled.

Application Settings

You can also activate a Third Party Authenticator app via the LEAP Application Settings.

Click to edit heading

Desktop: Click the LEAP Menu > Settings > Application Settings.

The LEAP Application Settings will open in a new window.

Web: Click > Settings > Application Settings.

The LEAP Application Settings will open in a new tab.

If you do not have permissions to access the LEAP Application Settings, you can still access the Multi-factor authentication settings via Staff Settings to activate your Authenticator app.

To access Staff Settings, click the LEAP Menu > Settings > under Apps > Staff Settings, then proceed from Step 4.

Click Firm > under Staff > Members.

The Staff Members List will be displayed.
Click your name to open your staff profile from the Staff Members List.
Click Multi-factor authentication on the left.
Under Multi-Factor Authenticator Apps, click Enroll next to Other Authenticator.

Click to edit heading

If you have another Authenticator on your phone already, do not select LEAP Authenticator, use Other Authenticator.
Enter your LEAP password.

Click Continue.
Instructions on how to set up multi-factor authentication with an authenticator app of your choice will be displayed.
Download an Authenticator app of your choice. For example, Microsoft Authenticator or Google Authenticator.
Scan the QR code using your authenticator app, or manually enter the key shown.
Once added, you will see a list of accounts in your Authenticator app.

LEAP will show in the list, along with your LEAP username and 6-digit MFA code.
Enter the MFA code from your third party authenticator and update the Name if required.
Click Next.

After you enter a valid MFA code, you will receive a message that multi-factor authentication with your third party authenticator has been successfully enabled.

Signing into LEAP

Desktop

Log into LEAP Desktop with your username and password.
You will be prompted to enter a verification code.
Open your third party authenticator app to generate a code.
Enter the verification code displayed on your authenticator app into LEAP.
(Optional) Select Trust this device if you would like to bypass MFA on your current device for 30 days.

Click to edit heading

Do not choose this option if you’re using a shared computer.

Click Verify.

Click to edit heading

Please note that after six unsuccessful MFA code attempts, your account will be locked for 30 minutes.

Web

Log into LEAP Web with your username and password.
You will be prompted to enter a verification code.
Open your third party authenticator app to generate a code.
Enter the verification code displayed on your authenticator app into LEAP Web.
(Optional) Tick Trust this computer (for 30 days) if you would like to bypass MFA on your current device for 30 days. You can also update the Computer Name if needed.

Click to edit heading

Do not choose this option if you’re using a shared computer.

Click Authenticate.

Click to edit heading

Please note that after six unsuccessful MFA code attempts, your account will be locked for 30 minutes.

Trusted Devices

Trusting Devices & Browsers

Trusting devices can only be done after entering your username and password and during the MFA code challenge screen.

LEAP Desktop

Tick Trust this device before you click on Verify. Your desktop device is now trusted and will remain so until the device is un-trusted.

LEAP Web

Tick the option Trust this computer and update the Computer Name for easier identification, if necessary. The browser will be trusted for 30 days or until the browser history is cleared.

Click to edit heading

Devices can only be trusted for a maximum of 30 days.
Devices cannot be trusted via the Application Settings window.

Removing Trusted Devices

To remove a trusted device:

Click to edit heading

Please note that you can only remove trusted devices from your own account.

Click to edit heading

Desktop: Click the LEAP Menu > Settings > Application Settings.

The LEAP Application Settings will open in a new window.

Web: Click > Settings > Application Settings.

The LEAP Application Settings will open in a new tab.

If you do not have permissions to access the LEAP Application Settings, you can still access the Multi-factor authentication settings via Staff Settings to remove trusted devices.

To access Staff Settings, click the LEAP Menu > Settings > under Apps > Staff Settings, then proceed from Step 4.

Click Firm > under Staff > Members.

The Staff Members List will be displayed.
Click your name to open your staff profile from the Staff Members List.
Click Multi-factor authentication on the left.
Under Trusted Devices, click the bin icon next to the device you would like to remove.
Click Delete to continue.

A notification will be displayed to confirm that the trusted device has been removed.

Managing Authenticator Devices & Apps

Replacing Your Authenticator

You can replace your Third Party authenticator app if you wish to switch to a different one. For example, changing from Microsoft Authenticator to Google Authenticator.

Click to edit heading

Desktop: Click the LEAP Menu > Settings > Application Settings.

The LEAP Application Settings will open in a new window.

Web: Click > Settings > Application Settings.

The LEAP Application Settings will open in a new tab.

If you do not have permissions to access the LEAP Application Settings, you can still access the Multi-factor authentication settings via Staff Settings to replace your Authenticator app.

To access Staff Settings, click the LEAP Menu > Settings > under Apps > Staff Settings, then proceed from Step 4.

Click Firm > under Staff > Members.

The Staff Members List will be displayed.
Click your name to open your staff profile from the Staff Members List.
Click Multi-factor authentication on the left.
Under Multi-Factor Authenticator Apps, click the 3 dots icon next to Other Authenticator and click Replace authenticator.
Replacing the authenticator will remove the current authenticator and all trusted devices.

Click Continue to confirm.
Enter your LEAP password.
Instructions to replace your authenticator app will be displayed on the screen.

You can now download another Third Party Authenticator app and scan the QR code or manually enter the key to activate it.
Click Continue.
Enter a verification code from the new authenticator app to complete the pairing.

You can also update the Name of the authenticator.
Click Confirm.

Removing Your Authenticator

Click to edit heading

Please note that removing your account from your Third Party Authenticator app will not remove the Authenticator app enrolled in the LEAP Application Settings.

If you no longer have access to your mobile device, you may need to remove the currently enrolled Third Party Authenticator from the LEAP Application Settings before setting it up on a new device.

Some authenticator apps allow accounts and verification codes to sync to your account. If this feature is enabled, you may be able to install the authenticator app on another device and sign in to restore your verification codes.

If you cannot access your synced authenticator account, follow the steps below to remove the authenticator from the LEAP Application Settings:

Click to edit heading

Desktop: Click the LEAP Menu > Settings > Application Settings.

The LEAP Application Settings will open in a new window.

Web: Click > Settings > Application Settings.

The LEAP Application Settings will open in a new tab.

If you do not have permissions to access the LEAP Application Settings, you can still access the Multi-factor authentication settings via Staff Settings to remove your Authenticator app.

To access Staff Settings, click the LEAP Menu > Settings > under Apps > Staff Settings, then proceed from Step 4.

Click Firm > under Staff > Staff Members.

The Staff Members List will be displayed.
Click your name to open your staff profile from the Staff Members List.
Click Multi-factor authentication on the left.
Under Multi-Factor Authenticator Apps, click the 3 dots icon next to Other Authenticator and select Remove authenticator.
Removing the authenticator will remove the current authenticator and all trusted devices.

Click Continue to confirm.
Enter your LEAP password.

A notification will be displayed to confirm that the Third Party Authenticator app has been removed.

Click to edit heading

Please note that you will also need to manually remove the account from your Third Party Authenticator app to completely clear it.

Removing All Enrolled Authenticators (Admin Users Only)

Click to edit heading

Please note that the following feature is only available to LEAP Admin users only.

In some cases, your LEAP Admin user may need to remove all of your enrolled authenticators on your behalf.

Click to edit heading

Desktop: Click the LEAP Menu > Settings > Application Settings.

The LEAP Application Settings will open in a new window.

Web: Click > Settings > Application Settings.

The LEAP Application Settings will open in a new tab.

Click Firm > under Staff > Members.

The Staff Members List will be displayed.
From the Staff Members list, click the staff member whose authenticators you’d like to remove to open their profile.
Click Multi-factor authentication on the left.
Under Multi-Factor Authenticator Apps, click Remove Authenticators.
Removing all enrolled authenticators will require the staff member to re-enroll their authenticators.

Click Continue to confirm.
Enter your LEAP password.

The staff member will now be prompted to enroll an authenticator the next time they log in to LEAP.