Turn on two-factor authentication and require it for your team

You turn on two-factor authentication (2FA) under Settings → Security & Privacy → Personal Two-Factor Authentication, using an authenticator app such as Google Authenticator, Microsoft Authenticator, Authy, 1Password or Bitwarden. After that, LeadLex asks for a 6-digit code each time you sign in, on top of your password or your Google or Microsoft login.

Workspace admins can also require 2FA for every member, with a grace period to set it up.

Set up an authenticator app

1. Open Settings and choose Security & Privacy.
2. Under Authenticator App (Recommended), choose Set Up TOTP.
3. Scan the QR code with your authenticator app. If you cannot scan it, use the code under Can't scan? Enter this code manually:.
4. Type the 6-digit code from the app and choose Verify & Enable.
5. LeadLex shows Save Your Recovery Codes. Choose I've Saved My Codes to finish.

The card then reads "Your account is protected with two-factor authentication."

LeadLex shows recovery codes at this step, but the sign-in screen does not accept them today. If you lose your phone, use the email code described below.

An older option, Email-Based 2FA, sends a code to your email instead. It is marked as less secure than an authenticator app, so use the app if you can.

Sign in with 2FA

After your password, or after Continue with Google or Continue with Microsoft, LeadLex shows Verify Your Identity.

1. Open your authenticator app and type the current 6-digit code.
2. Choose Verify Code.

A successful check lasts 8 hours in that browser. Cancel signs you out again.

If you do not have your phone

On Verify Your Identity, choose Use Email Instead. LeadLex emails you a 6-digit code that works for 10 minutes. If it does not arrive, wait for the timer and choose Resend Code.

If you cannot use either, write to lexi@leadlex.com from your sign-in address.

Require 2FA for everyone (admins)

1. Open Settings → Security & Privacy.
2. Under Workspace Security (Admin Only), turn on Require MFA for all users.
3. Pick an MFA grace period: 1, 3, 7, 14 or 30 days. Seven days is the recommended choice.

Members get an email about the new rule. Until they enrol, they see a reminder banner with Set up 2FA. In the last 3 days the banner warns that their account will be restricted. When the grace period ends, LeadLex blocks the app with "Two-factor authentication is now required to continue" until they set up an authenticator.

Team MFA Status on the same card shows how many people have enrolled, for example "6 / 8 enrolled (75%)".

What happens next

If your firm signs in through Microsoft Entra ID or Okta, see Sign in with SSO.