# Turn on two-factor authentication and require it for your team

> Protect your LeadLex login with an authenticator app, sign in with a code, and as an admin require two-factor authentication for everyone in the workspace.

Source: https://www.leadlex.com/help/account/two-factor-authentication
Last updated: 2026-10-23

You turn on two-factor authentication (2FA) under **Settings → Security & Privacy → Personal Two-Factor Authentication**, using an authenticator app such as Google Authenticator, Microsoft Authenticator, Authy, 1Password or Bitwarden. After that, LeadLex asks for a 6-digit code each time you sign in, on top of your password or your Google or Microsoft login.

Workspace admins can also require 2FA for every member, with a grace period to set it up.

## Set up an authenticator app

1. Open **Settings** and choose **Security & Privacy**.
2. Under **Authenticator App (Recommended)**, choose **Set Up TOTP**.
3. Scan the QR code with your authenticator app. If you cannot scan it, use the code under **Can't scan? Enter this code manually:**.
4. Type the 6-digit code from the app and choose **Verify & Enable**.
5. LeadLex shows **Save Your Recovery Codes**. Choose **I've Saved My Codes** to finish.

The card then reads "Your account is protected with two-factor authentication."

LeadLex shows recovery codes at this step, but the sign-in screen does not accept them today. If you lose your phone, use the email code described below.

![Personal Two-Factor Authentication in Security and Privacy](/help/two-factor-authentication/personal-2fa.webp "Personal Two-Factor Authentication, under Settings, Security & Privacy.")

An older option, **Email-Based 2FA**, sends a code to your email instead. It is marked as less secure than an authenticator app, so use the app if you can.

## Sign in with 2FA

After your password, or after **Continue with Google** or **Continue with Microsoft**, LeadLex shows **Verify Your Identity**.

1. Open your authenticator app and type the current 6-digit code.
2. Choose **Verify Code**.

A successful check lasts 8 hours in that browser. **Cancel** signs you out again.

## If you do not have your phone

On **Verify Your Identity**, choose **Use Email Instead**. LeadLex emails you a 6-digit code that works for 10 minutes. If it does not arrive, wait for the timer and choose **Resend Code**.

If you cannot use either, write to [lexi@leadlex.com](mailto:lexi@leadlex.com) from your sign-in address.

## Require 2FA for everyone (admins)

1. Open **Settings → Security & Privacy**.
2. Under **Workspace Security (Admin Only)**, turn on **Require MFA for all users**.
3. Pick an **MFA grace period**: 1, 3, 7, 14 or 30 days. Seven days is the recommended choice.

Members get an email about the new rule. Until they enrol, they see a reminder banner with **Set up 2FA**. In the last 3 days the banner warns that their account will be restricted. When the grace period ends, LeadLex blocks the app with "Two-factor authentication is now required to continue" until they set up an authenticator.

**Team MFA Status** on the same card shows how many people have enrolled, for example "6 / 8 enrolled (75%)".

## What happens next

If your firm signs in through Microsoft Entra ID or Okta, see [Sign in with SSO](/help/account/single-sign-on).