If auto-login is enabled (azure AD) 2-factor authentication is only possible on first login attempt?

Question

I set 2Facotr authentication as mandatory as shown below.

Our organization uses Azure AD to log in.

when we first log in, we enter the 2-factor authentication step.

but,  if we are logged in automatically, skip the steps above and log in.

Can't we force the authentication step every time we enter Jira ?

ChangSoo Yoon · Answer

@Ed Letifov _TechTime - New Zealand_

1) If I enter the ID directly, 2 Factor works.

However, if I enter by clicking Microsoft account below, I will be automatically signed in.(no 2 Factor)

Both are the same account.

I want to 2Factor in all cases, is there a way?

Ed Letifov _TechTime - New Zealand_ · Answer

Hello @ChangSoo Yoon

1) If you are logging with SSO (the 1st option in the screenshot) via Azure AD then the 2FA is done on Azure AD side, not Atlassian Cloud.

Please note clicking on "Continue with Microsoft" is not SSO in terms of Atlassian, it's just a convenient "shortcut".

2) Does your 2FA screen actually have Atlassian's logo at the top? Like this:

If not – then you are entering 2FA on Azure AD side, and the setting to do it every time or only once has to be set on Azure AD side

3) Can you clarify what exactly happens when you "are logged in automatically"? You click on the link in your email or open browser and type Jira URL directly, and then what happens? What is the next screen you see?

I suspect you are not actually "logged in" you just allowed access based on the cookies that are still valid.

4) Clearly you have Atlassian Access, since you are configuring billable features in the user policy – the last setting in your screenshot is the session validity. You could reduce this to some small value. Please note however, that very short values WILL affect behaviour e.g. Jira issue create screen will timeout after the session becomes invalid.