Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in
Celebration

Earn badges and make progress

You're on your way to the next level! Join the Kudos program to earn points and save your progress.

Deleted user Avatar
Deleted user

Level 1: Seed

25 / 150 points

Next: Root

Avatar

1 badge earned

Collect

Participate in fun challenges

Challenges come and go, but your rewards stay with you. Do more to earn more!

Challenges
Coins

Gift kudos to your peers

What goes around comes around! Share the love by gifting kudos to your peers.

Recognition
Ribbon

Rise up in the ranks

Keep earning points to reach the top of the leaderboard. It resets every quarter so you always have a chance!

Leaderboard

Come for the products,
stay for the community

The Atlassian Community can help you and your team get more value out of Atlassian products and practices.

Atlassian Community about banner
4,459,749
Community Members
 
Community Events
176
Community Groups

Service Desk not working with Office 365 with 2FA enabled

Hi and apologies if this is a duplicate post; in fact I would be surprised if it isn't however after many hours of googling over several days I cannot find a solution to what I thought would be a very common and simple issue.

 

Service desk works fine with O365 IMAPS - config below

Email - full email address

Password - password

Mail server - outlook.office365.com

Protocol - IMAPS

Port - 993

 

However when I enforce 2fa it stops working - no great surprise there, however I cannot see any way of providing Jira with the 2fa password and any other options to get past this.

 

Any advice would be much appreciated.

2 answers

I have same issue. created app password for O365 but also not working.

Daniel Eads Atlassian Team Oct 25, 2021

Hi @Pravesh Mathema ,

For JSM Cloud as this question was originally asked, you'll now want to use OAuth, as described in Switch your Microsoft and Google email accounts to OAuth . If you're using a different product or deployment type, let me know and I can point you in the right direction.

Cheers,
Daniel | Atlassian Support

I am using self hosted Jira Service desk. still no luck.

0 votes
Daniel Eads Atlassian Team Dec 02, 2020

Hi Phil, welcome to the Community and thanks for reaching out!

When 2FA is enabled for Office 365, you'll need to issue an app password for Jira to connect to the mailbox. This is a separate password from what you'd use for the account, and allows Jira (or another application) to bypass 2FA. You enter this in the standard password field in the application (and you don't enter the normal account password anymore).

The Microsoft documentation for using app passwords is available here - and although it's at the top of the document, I want to call out here as well that app passwords need to be enabled for your organization by an Azure/Office365 admin, or you won't see the options mentioned in the rest of the documentation that allow you to create a new one.

Cheers,
Daniel

Hi Daniel and thanks for the response. Have turned 2fa back on this morning but it takes a while before I can test it. A little confused though because if there is only 1 password, then it is not 2fa... 2fa by definition is 2 methods of authentication.

Daniel Eads Atlassian Team Dec 03, 2020

That's a correct assessment! This is partially why Microsoft requires you to enable app passwords separately before they can be created.

The app passwords are randomly generated, and long - so they:

  1. Aren't likely to be brute-forced
  2. Won't be re-used across other sites like a user password might be (a security risk if someone is able to get the password table from a less secure site where the password was reused)

From the standpoint of "how would an application interact with 2FA" - there are some pitfalls. For common second factors:

  • Hardware tokens: there's no way to plug a security device into a cloud-hosted application
  • Push notifications: you probably don't want to be clicking "approve" on your phone every 60 seconds while Jira is checking mail
  • SMS / 6 digit one-time-passcodes - if these don't expire every 60 seconds and instead have an indefinite life, they're no different than a password

As a future state, I would lean toward OAuth for mail authentication rather than basic auth with a username/password. We're still adding OAuth as an authentication mechanism for mail in Jira Service Management Cloud, but you can follow along with the progress here: JRACLOUD-72590 

Hi Dan, sorry for the late reply and thank you for all your help so far. I've had to remove 2FA for the moment as I can't seem to get it working. After your above explanation, I have done the following:

Turned 2fa back on in O365 portal - without any changes in Jira it continued to work for several hours before any issues - I'm assuming it takes time to populate various servers with the change ?

Created a password for Jira.

Successfully connected service desk with this password.

Tickets could be received but replies were no longer getting back to the reporter. I will try again when I have the time for the service desk to be 'down' for a day as I'm sure it must be something simple. Doesn't make sense that it could receive but not send.

I am adding the email as 'custom' because if I try and add 'Microsoft' account, it defaults to my own email address and I cannot for the life of me find a way to change to my support@ email.

Strike that, after trying to do this many many times when over the first month or so of having an account without success, it suddenly now lets me choose another of my o365 accounts....  I'm not crazy my mother had me tested.

Like Daniel Eads likes this

Suggest an answer

Log in or Sign up to answer
DEPLOYMENT TYPE
CLOUD
PRODUCT PLAN
FREE
PERMISSIONS LEVEL
Site Admin
TAGS

Atlassian Community Events