Troubleshoot 2FA with Standard Confluence subscription

[Howard Phillips]

We have a Standard level Confluence subscription and have recently changed the default security policy to enforce two factor authentication.

If a user needs to reset their 2FA (e.g. they've got a new phone), then the Confluence support article suggests moving them to a security policy that doesn't enforce 2FA to allow them to set it up. However, the Standard level Confluence subscription only allows one security policy (the default), so we cannot create another policy to allow log-in without 2FA.

Does anyone have a work-around for this that doesn't involve either taking out a Guard subscription or temporarily disabling 2FA enforcement in the default policy?

Thanks,
Howard Phillips

[Howard Phillips · Accepted solution]

This is Atlassian's AI Support chart response to the question:

Unfortunately, with a Standard level Confluence subscription, you are limited to a single default security policy, which means you cannot create an additional policy to bypass two-factor authentication (2FA) for specific users. The typical workaround involves temporarily disabling 2FA enforcement in the default policy, which you mentioned you want to avoid.

Here are a couple of potential solutions:

1. Temporarily Disable 2FA Enforcement: This is the most straightforward approach, although it involves a temporary reduction in security. You would disable 2FA enforcement, allow the user to reset their 2FA, and then re-enable it.
2. Contact Atlassian Support: Given the limitations of your current subscription, reaching out to Atlassian Support might provide additional options or temporary solutions tailored to your specific needs.

Unfortunately, without upgrading to a plan that supports multiple security policies or using Atlassian Access, these are the primary options available. If you need further assistance, please consider contacting Atlassian Support directly for more personalized help.

So it looks like 'temporarily disable 2FA enforcement' is going to be the easiest, if less than ideal, solution.

[Marc - Devoteam]

Hi @Howard Phillips 

This I can't see another solution for then getting Atlassian Guard, but as Atlassian has made it possible to enable this after verifying a domain, there should be a solution for this.

It seems this is not documented or it might no even be there. You might need to edit the policy and disable the 2FA.

But I can't be sure.

You will need to contact Atlassian Support

[Howard Phillips]

Thanks @Marc - Devoteam .
I suspect that you're correct and the only option is to temporarily disable 2FA in the default policy.
I'll follow your suggestion and contact Atlassian Support. If I get anything helpful in return, I'll post it here.
Howard