Is there a way to check users’ 2FA status via API without Atlassian Guard or domain verification?

Question

We’d like to know if it’s possible to retrieve the two-factor authentication status of users - including those from external domains - using a REST API, even when Atlassian Guard is not enabled and domain verification is not available. As of now, it seems Atlassian does not provide any public API for this. Can you confirm if there’s any workaround or upcoming support for this use case?

Vishalakshi Narayana Swamy · Answer

Hi @Tri Ung

Welcome to Atlassian Community!

Checking the available APIs, I’m afraid to say that it’s not possible to get such information.

In case your site has Atlassian access and if the domain is verified, you can make two-factor authentication optional or not and it’s also possible to see accounts that have two-step disabled.

Enforce two-step verification

This is being tracked in the feature request here https://jira.atlassian.com/browse/ID-8378 as well.

You can also refer to https://developer.atlassian.com/cloud/admin/rest-apis/ for our available endpoints for user management.

Best Regards,

Vishalakshi Narayanaswamy

Tomislav Tobijas · Answer

Uh, hardly without Guard, but that's an interesting question @Tri Ung 👀
I'll ask if someone from Atlassian can comment on this, as it might be relevant to other people as well.