nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

2FA Atlassian Access External Users

Mike Bell_hoedly

Within Atlassian Access I have all of my users setup via OKTA. However there are some "external" users that are not managed via OKTA.

In Security -> External Users -> External User Policy the "Two-factor verification" setting has no options to set.

How do I setup 2FA for external user accounts?

Thanks,

Mike

Accepted answers

Marc -Devoteam-

Hi @Mike Bell

You can just enable this. The users will need an authentication app on their mobile.

The accounts are still Atlassian accounts.

All comments

Marc -Devoteam-

Hi @Mike Bell

You can just enable this. The users will need an authentication app on their mobile.

The accounts are still Atlassian accounts.

Mike Bell_hoedly

Hi @Marc -Devoteam-

Correct me if I'm wrong, but I believe that you are referring to an authentication policy where I can enable and disable 2FA. What I am referring to is an "External User Policy" under Security -> External Users. There does not seem to be any option for 2FA settings. The external users are not managed accounts. If there is a way that I could use an authentication policy instead, it would be great, but I don't think that I can.

Thanks,

Mike

Marc -Devoteam-

Hi @Mike Bell

No there is no option for 2FA based on external users in that specific policy.

But if the users are in your org (they have an account), you can also create a specific authentication policy and add only those users, then you can enable 2FA.

Mike Bell_hoedly

Hi @Marc -Devoteam-

Thank you for your help with this question. I am going to call this a big fat fail for Atlassian. How could putting 2FA on less secure accounts (accounts that I have no real management over) be an afterthought or not an option at all.

90% of my accounts are managed by OKTA (safe and secure), but the other accounts that I cannot control are not able to be properly secured.... Wow!

Again, thanks for your help. I appreciate it.

Mike

Philip Schlesinger

Q to @Marc -Devoteam- :

Does this ability to force external users -- that is, users with email address from un-managed domains for our Atlassian org -- to verify their identity with an extra step at a set frequency -- come with Atlassian Guard Standard?

Marc -Devoteam-

Hi @Philip Schlesinger

Yes, this is a default setting within Atlassian Guard

William Crighton_j9bp4u

I don't believe this is true - Authentication Policies only apply to managed accounts which excludes all external accounts.

Maybe I'm missing something but I cannot add any external users to an Authentication Policy. And it's only in authentication policies that you can enforce the two-step verification.

The two-factor verification is not the same, and all these external users will still appear on the insights page as "Two-step verification not enabled"

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira

cloud

jira-cloud