How do I enable and manage multifactor authentication in Confido Legal?

What is Multifactor Authentication?

Multifactor authentication provides an additional layer of protection for your Confido Legal account beyond your username and password.

MFA is required for firms using Confido Legal disbursements. Because authorized users may have access to initiate and manage the movement of funds, an account takeover could give a bad actor broad access to the firm’s account and create a risk of unauthorized funds being moved.

Requiring MFA makes an account takeover significantly more difficult by requiring users to verify their identity using a second authentication method, even if their login credentials have been compromised.

This requirement is designed to help protect your firm, your clients, and the funds managed through your Confido Legal account.

Prerequisites

You must be an Admin on your Confido Legal account.

Note: This article applies only to those using their email to login to Confido Legal. If you are using Google login, you can manage multifactor authentication through your Google account.

Enabling Multifactor Authentication

Multifactor authentication is turned off by default.
To enable multifactor authentication at the firm level, navigate to Settings > Firm Settings > Multifactor Authentication. Turn on multifactor authentication. This will require all users at the firm to enable multifactor authentication when they are invited or when existing users next login.

Initial Login and Setup

When a user logs in for the first time after the firm has enabled multifactor authentication, they will be presented with a QR code. Open your preferred authenticator app and scan the QR code.

Note: If you do not have a preferred authenticator application, here are a few recommendations:

Google Authenticator (Android) (iPhone)
Microsoft Authenticator (Android) (iPhone)
Authy
Duo Mobile
LastPass Authenticator (Android) (iPhone)

Your authenticator app will walk you through the setup process and present a 6-digit code specifically for Confido Legal.
Enter the 6-digit code from your authenticator app and click Save.
You will be logged in to Confido Legal, and multifactor setup is complete.

Disabling Multifactor Authentication at the Firm Level

If your firm uses Confido Legal disbursements, MFA is required and should remain enabled at the firm level. Disabling MFA reduces an important protection against account takeover and unauthorized movement of funds.

To disable multifactor authentication at the firm level, navigate to Settings > Firm Settings > Multifactor Authentication. Turn off multifactor authentication.
This will keep new users from being required to setup multifactor authentication. It will not turn multifactor authentication off for those who have already enabled it.

Disabling Multifactor Authentication at the User Level

For firms using Confido Legal disbursements, MFA should not be disabled for active users. If a user is having difficulty accessing their authenticator or completing MFA, contact Confido Legal Support for assistance rather than removing the security requirement.

To disable multifactor authentication at the user level, navigate to Settings > Users > Active Users. Click on the specific user and turn off multifactor authentication.
Once deactivated, this user will no longer be required to provide multifactor authentication at login.