Two-factor authentication setup for administrators

This article explains how to enforce two-factor authentication (2FA) for every user in your Legalsense environment, and how to optionally whitelist trusted IP addresses to reduce login friction for users signing in from trusted networks. It covers the administrator side of 2FA; for adding or removing your own personal 2FA device, see the article ↪ Configuring two-factor authentication.

What 2FA means in Legalsense

Two-factor authentication (2FA) strengthens access control by requiring two independent factors during login. In Legalsense, the first factor is the user's username and password. The second factor is a time-based one-time password (TOTP) generated by a registered 2FA device, such as an authenticator app or a password manager with TOTP support. In the login flow and UI, Legalsense refers to this OTP as a security token.

Enforce 2FA system-wide

You configure installation-wide enforcement of 2FA in the security settings.

Legalsense Settings → Security → Account settings page with the Enforce two-factor authentication checkbox enabled, alongside the option to limit users to a single session.

1. Go to Settings → Security → Account settings.
2. Enable Enforce two-factor authentication.

Once you enable enforcement, every user must use 2FA. Legalsense redirects users who haven't yet registered a 2FA device to the mandatory setup flow on their next login. After completing setup, users must provide a security token each time they sign in, unless an exception applies.

Note: Users who log in with single sign-on (Sign in with Microsoft) aren't asked for a security token. The security settings of their Microsoft account apply instead.

Optional: whitelist trusted IP addresses

To reduce login friction on trusted networks, you can whitelist specific IP addresses. When a user signs in from a whitelisted IP address, Legalsense treats that IP address as the second factor and doesn't prompt the user to enter a security token. This applies to all users, whether or not 2FA is enforced.

1. Go to Settings → Security → Whitelisted IP addresses.
2. Click Add IP address.
3. Enter either:
   • A single IPv4 address (example: 203.0.113.10)
   • A CIDR range (example: 203.0.113.0/24)

Legalsense Settings → Security → Whitelisted IP addresses page showing an empty whitelist and the Add IP address button for configuring trusted IPv4 addresses or ranges.

Administrators commonly use IP whitelisting for office networks with a stable egress IP, or for third-party systems that integrate with Legalsense from a fixed location. Because whitelisting reduces the effective strength of 2FA for traffic originating from those IPs, apply it only to controlled and well-understood network ranges.

Troubleshooting

A user lost their 2FA device

Legalsense doesn't provide backup codes, and a user can't add a new device without a code from an existing one. Delete the user's device so they can set up a new one:

1. Go to Users → Users and open the user.
2. Open the Security tab.
3. Under 2FA devices, click the delete icon next to the device.
4. Enter your own security token to confirm.

The user can then click No 2FA device? on the login page and set up a new device through the link in the email.

Note: You need permission to manage users, and a 2FA device of your own, to delete another user's device. If nobody in your firm can do this, contact Legalsense Support.

A user is blocked after too many failed attempts

After 10 failed login attempts, Legalsense blocks the login for that user from that IP address for 2 hours. To unblock it earlier:

1. Go to Settings → Security → Blocked accounts.
2. Click Unblock next to the user.

Users are logged out unexpectedly

Go to Settings → Security → Account settings and check these settings:

• Maximum time of inactivity: Legalsense logs users out after this many minutes without activity.
• Bind IP address to session: Legalsense logs a user out when their IP address changes, for example when they switch networks or use a VPN or mobile connection that changes IP address. Clear this setting if this happens often in your firm.
• Limit users to a single session: logging in on another device or browser ends the earlier session.