Enforce MFA and Password complexity for Customers

[Matthew Crocco]

I am setting up an internal JSD and looking to have Jira Access for SSO and enforce MFA for the agents. Is there a way to make the same requirements for our customers as well?

It seems the current setting the customer can use anything for a password.

Thanks

[Angélica Luz · Accepted solution]

Hello Matthew,

Thank you for reaching out to Atlassian Community!

When using Atlassian access, currently, SSO, password policy, and 2FA are only applicable to internal users and not customers.

Customers use a different URL to login and also their accounts are local, it's not an Atlassian account, that's why it's not possible to use Atlassian access for their accounts.

There are some feature requests suggesting the implementation of such ability:

• SSO integration with JIRA Service Desk
•  Include password policy configuration for portal only customers.
• Provide the ability to configure 2FA for portal customers

Please, click on vote and watch to receive updates about the features.

Regards,
Angélica

[Matthew Crocco]

Thanks Angelica,

Does this apply as well if I have a verified domain and the customers email addresses are claimed and managed?

Thank you

[Angélica Luz]

That's actually a workaround, Matthew.

You can migrate the customers to Atlassian account, so you can manage their accounts. 

When migrating their accounts, they will be listed as internal users, and for them to use only the portal, you need to make sure that they are not added to any default groups.

Before migrating, go to Cog Icon > User management > Product access and disable all the products, so new users won't receive a license, therefore, customers migrated won't be part of any groups.

Once their accounts are managed, they will log in using the same URL as any other user (xxxxxxx.atlassian.net) and not the portal, but since they won't be part of any default groups, they will be redirected to the customer portal.