Require two-factor for your whole team in Leadnote

You can require every person in your organisation to protect their account with two-factor authentication. Account Owners and Managers can switch this on in Settings, then Security, and pick a grace period so people have time to set it up. This article explains the settings, what your team sees, and how to check progress.

Before you start

• You need to be the Account Owner or a Manager, and a Manager also needs permission to edit Settings (Managers have it by default). L1 Users and L2 Users cannot change this policy.
• Set up your own two-factor first, so you know what your team will go through. See two-factor authentication.

Switch the requirement on

1. Open Settings, then Security.
2. In the Require two-factor authentication card, turn on Require two-factor for everybody.
3. In Grace period (days), enter a whole number from 0 to 90, or pick a preset: Immediately, 7 days, 14 days or 30 days. The hint under the field says that 0 means people must set it up at their next sign-in.
4. Select Save policy.

If you choose Immediately, Leadnote first asks "Require two-factor immediately?" and explains that everybody without two-factor must set it up the next time they sign in. Select Require it now to go ahead.

The card's label changes from Not required to Required. To stop requiring it, turn the switch off and select Save policy. Nobody loses the two-factor they already set up.

What your team sees

During the grace period

People without two-factor can sign in as usual. A banner shows: "Your organisation requires two-factor authentication. Set it up by (date) to keep signing in", with a countdown and a Set up two-factor button. The button opens the Security tab of their profile. The same warning appears on their Two-factor authentication card.

After the grace period

At their next sign-in, a person without two-factor reaches a Set up two-factor screen instead of the app. It says: "Your organisation requires two-factor authentication. Set it up once to continue." They scan a QR code, enter a code, save their recovery codes, and then they are signed in. They cannot skip this screen.

People who are already signed in when the period ends are not interrupted. Their open sessions keep working until they sign in again.

The rule applies to everyone, including people you add later. A new user who joins after the grace period ends sets up two-factor at their first sign-in. See add and invite users.

On the mobile app

The Leadnote mobile app follows the same rule. After the grace period, someone without two-factor is taken through setup when they sign in. The app calls the feature two-step verification.

Track who has set it up

The Require two-factor authentication card shows a meter, People with two-factor, with a line such as "6 of 8 active people have it on" and how many people have not set it up.

Further down the Security page, the Security summary card shows:

The table under it lists each person with their role, whether two-factor is on, and when they were last active. Select Show only people without two-factor to build your chase list. If you have more people than fit, it shows the most recently active ones and links to the staff directory for the rest.

Help someone who is locked out

If a person loses their phone and all recovery codes, you can reset their two-factor:

1. Open Users and find the person.
2. Select Reset two-factor and confirm.
3. Enter your own password, and a code from your authenticator app if you use one.

Leadnote removes their authenticator, recovery codes and trusted devices, signs them out everywhere and emails them. At their next sign-in they set up two-factor again. A Manager can reset an L1 User or an L2 User but not another Manager. Only the Account Owner can reset a Manager. Nobody in the organisation can reset the Account Owner's two-factor. See sensitive actions and step-up for the other actions that ask for your password again.

A sensible rollout

1. Tell the team in advance and share the setup steps.
2. Pick a grace period of 7 to 14 days.
3. Check the meter after a few days and chase the people listed under Without two-factor.
4. After the grace period ends, expect a few reset requests from people who lost a phone.