nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

DUO is not being triggered every 14 days

Bob Sochacki

We setup our DUO cloud instance to have the certificate live for 14 days so users will regularly get prompted for MFA. Users are not getting prompted every 14 days to authenticate with DUO. If they logout it happens consistently.

Wondering if there is a setting we are missing?

Thanks!

Accepted answers

Petter Gonçalves

Hello @Bob Sochacki

Welcome to the Atlassian Community!

Per your description, I understand the two-factor authentication you configured with DUO is not being triggered in the time you stipulated unless the user selects to logout from his account. Is that correct?

It is expected behavior that the two-factor authentication is not triggered if the user still has a logged session in the Cloud site. That being said, please follow the steps of the documentation below to set a timeout limit to drop out the session and enforce the two-factor authentication with DUO:

Session duration management

Basically, the steps are:

Access your organization at admin.atlassian.com and click Security (at the header of the page) > Session duration.
From the Idle session duration dropdown, select the amount of time you want.

P.S: The steps mentioned in the documentation above are only applicable to your Managed accounts.

Let us know if you have any questions.

All comments

Petter Gonçalves

Hello @Bob Sochacki

Welcome to the Atlassian Community!

Session duration management

Basically, the steps are:

Access your organization at admin.atlassian.com and click Security (at the header of the page) > Session duration.
From the Idle session duration dropdown, select the amount of time you want.

P.S: The steps mentioned in the documentation above are only applicable to your Managed accounts.

Let us know if you have any questions.

Bob Sochacki

Petter, that is correct. I will have our admin take a look at this setting and if not set take care of it.

Bob Sochacki

According to Jira documentation: A session is idle when users don’t interact with the product during that period of time. Interactions can be active (a user clicks a button) or passive (an open page auto refreshes).

Do most pages refresh regularly to check for updates or only if there is an update? So, if there is no activity over a weekend, then we could set it to 36 hours and that would force a logoff?

Trying to determine how to not annoy the users while at the same time prompting regular MFA for users.

Petter Gonçalves

Hello @Bob Sochacki

Usually, an open page does not update itself without the action of the user if he is not currently visualizing it. The only thing that would not follow this behavior would be if you have any automation rule that could trigger an action from the user.

That being said, if you set your session to timeout after being idle for 36 hours, it might drop your user's session during the weekend.

I suggest testing what would better work for your team, once this is a setting that can be easily changed if any annoyance is applied.

Let us know if this information helps.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Unanswered
Groups
Help

Find more posts tagged with

cloud

jira-software

jira-software-cloud