Missed Team ’24? Catch up on announcements here.

×
Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Can you enforce 2FA for non-managed invited users?

Andrei March 26, 2020

We have an organization, a verified domain, and claimed accounts. 

We'd also want to invite users from outside of our organization (domain) to access and be part of our Confluence Cloud instance. 

As we'd like access to our data to be as secure as possible, is there a way to enforce them to have 2FA enabled?

- Something like.. if this user doesn't have 2FA enabled AND isn't logged with OAuth(Google, AD, etc), don't allow them to access our instance.

2 answers

1 accepted

3 votes
Answer accepted
Jimmy Seddon
Community Leader
Community Leader
Community Leaders are connectors, ambassadors, and mentors. On the online community, they serve as thought leaders, product experts, and moderators.
March 26, 2020

Hi @Andrei,

Welcome to the Community!

I'm pretty sure that that only way to enforce 2FA would be to create "contractor" accounts in your organization.  I don't think Access allows to to control anything with accounts outside your organization.

I hope that helps answer your question.

-Jimmy

Andrei March 27, 2020

Hi @Jimmy Seddon 

Thank you for your quick response. 

You're right. Documentation says it's not possible, only for managed accounts (with verified domains).

I'm thinking it still might be useful to do a check for users that are invited via email or already have an Atlassian account.

A check that tells me if the user has 2FA enabled. I can then choose not to allow access to my Confluence instance unless they do.

Sharing my Conf instance is compromised if they have an easy to guess pass and no 2FA.

Thoughts? Do you know if something of the sort might be in Atlassian's pipeline?

 

Andrei.

Jimmy Seddon
Community Leader
Community Leader
Community Leaders are connectors, ambassadors, and mentors. On the online community, they serve as thought leaders, product experts, and moderators.
March 27, 2020

Hi @Andrei,

Looks like it's something that has been reported at the very least:
https://jira.atlassian.com/browse/ACCESS-797

I'd recommend commenting on that issue with your specific use case details, and voting for and watching that issue for updates.

-Jimmy

Like Andrei likes this
Dave Meyer
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
March 27, 2020

We're currently planning to implement visibility into which users on your site have enabled 2FA relatively soon (ACCESS-797). We do have a plan for supporting actual enforcement of mandatory 2FA on external accounts; however this is going to take quite a bit longer. Follow ACCESS-102 for that one.

Thanks!

Dave 

Like # people like this
Andrei March 30, 2020

That's great news! I'll follow both of them. As soon as it gets done, I'll get customers back on board to Access...

0 votes
Michal Patoprsty November 14, 2022

Suggest an answer

Log in or Sign up to answer
TAGS
AUG Leaders

Atlassian Community Events