Control of password strength and 2-factor authentication for guest accounts

[Frank Bernhardt]

We are using SAML and 2 factor authentication for our Jira and Confluence users. We now have very often external team members that need access. They will use their own e-mail to sign on. If I give them access to our URLs, do I have any control over the password strength that they use?

[Daniel Eads · Accepted solution]

Hi Frank,

Since Cloud users can be members of multiple instances, password policies are set at the email domain level rather than at each individual Jira/Confluence instance.

I'm guessing from your previous question that you've already gotten familiar with Atlassian Access (formerly known as Identity Manager). That's how organization owners set password policies, but it's specific to accounts for the email domain owned/claimed by that company.

In this sense, you control the password strength for your employees working across all Atlassian Cloud instance (even ones that you don't manage). But the downside as you're finding out is that you're at the mercy of "external" vendors to set the password strength for accounts in their organization. Erego, if the external team members have an email like vendor@stranger.com, someone would need to verify stranger.com with Atlassian Access to apply password policies to those users.

The minimum password strength for non-managed accounts is 8 characters (no complexity requirements). We hope users are selecting passwords stronger than this, but their domain would need to be verified with Atlassian Access to enforce a different policy.

Cheers,
Daniel

[Frank Bernhardt]

Thank you. That would mean that if we want to enforce the password strength we would need to enforce that the people would use a P&G email.

Thanks