2FA Atlassian Access External Users

[Mike Bell]

Within Atlassian Access I have all of my users setup via OKTA. However there are some "external" users that are not managed via OKTA. 

In Security -> External Users -> External User Policy the "Two-factor verification" setting has no options to set. 

How do I setup 2FA for external user accounts?

Thanks,

Mike

[Marc - Devoteam · Accepted solution]

Hi @Mike Bell 

You can just enable this. The users will need an authentication app on their mobile.

The accounts are still Atlassian accounts.

See also; manage-two-step-verification-for-your-atlassian-account 

[Mike Bell]

Hi @Marc - Devoteam 

Correct me if I'm wrong, but I believe that you are referring to an authentication policy where I can enable and disable 2FA. What I am referring to is an "External User Policy" under Security -> External Users. There does not seem to be any option for 2FA settings. The external users are not managed accounts. If there is a way that I could use an authentication policy instead, it would be great, but I don't think that I can.

Thanks,

Mike

[Marc - Devoteam]

Hi @Mike Bell 

No there is no option for 2FA based on external users in that specific policy.

But if the users are in your org (they have an account), you can also create a specific authentication policy and add only those users, then you can enable 2FA.

[Mike Bell]

Hi @Marc - Devoteam 

Thank you for your help with this question. I am going to call this a big fat fail for Atlassian. How could putting 2FA on less secure accounts (accounts that I have no real management over) be an afterthought or not an option at all.

90% of my accounts are managed by OKTA (safe and secure), but the other accounts that I cannot control are not able to be properly secured.... Wow!

Again, thanks for your help. I appreciate it.

Mike

[Philip Schlesinger]

Q to @Marc - Devoteam :

Does this ability to force external users -- that is, users with email address from un-managed domains for our Atlassian org -- to verify their identity with an extra step at a set frequency -- come with Atlassian Guard Standard?

[Marc - Devoteam]

Hi @Philip Schlesinger 

Yes, this is a default setting within Atlassian Guard

[William Crighton]

I don't believe this is true - Authentication Policies only apply to managed accounts which excludes all external accounts.

Maybe I'm missing something but I cannot add any external users to an Authentication Policy. And it's only in authentication policies that you can enforce the two-step verification.

The two-factor verification is not the same, and all these external users will still appear on the insights page as "Two-step verification not enabled"