Actions that ask for your password again in Leadnote

For a few sensitive actions, Leadnote asks you to confirm again even though you are signed in. You always enter your own password. If you have two-factor sign-in turned on, you also enter a fresh 6 digit code from your authenticator app for most of them.

This is called step-up. It protects the account if someone finds your screen unlocked.

Which actions ask again

The two-factor steps are explained in Two-factor authentication and the recovery codes guide. Deleting an account or organisation is covered in Delete your account or organisation.

The confirmation box

When an action needs step-up, the dialog shows a field called Your password. If you use two-factor, it also shows a field for the 6 digit code from your authenticator app. The hint reads "To confirm it is you, enter your own password", or, with two-factor, "enter your own password and a code from your authenticator app".

If you enter a wrong password the dialog says "Your password is incorrect." and nothing changes. Enter the right password and try again. After several wrong passwords in a row (5 within 15 minutes) Leadnote pauses these confirmations for a few minutes.

Set a password or reset two-factor for someone else

Owners and Managers can help a colleague who is locked out. Both actions are in the row menu on the Users page.

1. Open Settings, then Add & Manage Users / Team.
2. Open the row menu of the person and choose Set password or Reset two-factor. Reset two-factor only appears for people who have two-factor turned on.
3. Enter Your password, and the code if you use two-factor.
4. For Set password, type the New password. Tick Ask the person to choose a new password at next sign-in if you will share it with them.

Both actions sign the person out everywhere. Set password also forgets their remembered browsers and cancels any invitation link still open. Reset two-factor also removes their authenticator app, recovery codes and trusted devices, and they get an email about it. If your organisation requires two-factor, they must set it up at their next sign-in. See Require two-factor for your team.

The rank rule

Roles rank Account Owner, then Manager, then L1 User, then L2 User. You can only act on someone who ranks strictly below you.

Only the Account Owner can set the owner's password or reset the owner's two-factor. You cannot use these dialogs on yourself. Use the Security tab of My Profile on the web, or Change my password under user settings in the mobile app.

On the mobile app

On the mobile app, owners and managers can set a password and reset two-factor from Manage users. The same confirmation applies: the app asks for Your password. Swap ownership and organisation deletion are web app actions.

Tips

• Turn on two-factor for the Account Owner and Managers. Then these actions are protected by a second step.
• Share a temporary password through a private channel and keep the box Ask the person to choose a new password at next sign-in ticked.
• Changes to other people's passwords, two-factor and ownership are recorded in the audit log.

If someone cannot sign in at all, see Can't log in.