Managed user can change his password

Question

Hi all,

We have the following situation:

We are using "Continue with Google" as login option to our Jira Instance. Currently, we are making a research for 2FA and suddenly we met a user who is able to set it for himself. According the Atlassian documentation: "Atlassian two-step verification is not applied if you login with Google, Microsoft or SAML single sign-on. ".

As we understand it, if you are logged in with Google account, 2FA is not possible.

So, I tried with my account but the very first step of 2FA is entering my account password, when I enter it - it rejects it as incorrect.

But, one of our users can do that, he even can log in with the same credentials without using Log In with Google option.

Any ideas why is this is happening and how we can identify who else can do that?

Thanks in advance all for your answers!

Cheers,

Magdalena Zhisheva

Magdalena Zhisheva · Answer

Hi @Kian Stack Mumo Systems ,

Well, we do not use Atlassian Access. But we are able to use "Continue with Google" Login and I can see that the user is part of the default (and only one) authentication policy for our organisation.

Kian Stack Mumo Systems · Answer

@Magdalena Zhisheva, You need to ensure that the user is inside of an authentication policy inside Atlassian access which is enforcing SAML SSO.