admin.atlassian.com MFA enforcement missing

[Antti Salo _Ambientia_]

Hi!

I've been trying to find a way how to enforce MFA for external admins in admin.atlassian.com but it seems this can't be done. I asked about this from Atlassian Support, and apparently external user mfa (the email verification) applies only when accessing products (Jira, Confluence).

So, when an organization has external admins who need to use admin.atlassian.com, we have a potential security issue, as there seems to be no technical way to verify or to enforce them to use MFA when accessing admin.atlassian.com.

Does anyone have a solution for this? Am I missing something?

BR,

Antti Salo, Solutions Expert @ Ambientia Group Oy, Atlassian Platinum Partner

[Steven Haworth]

I don't have any answers, but I'd like the same functionality available.

[David Cowley]

I likewise have no answers, if those external admins are part of another organization and that organization is managing their domain, that organization can use an identity provider and that identity provider could require MFA/2FA, but as an external organization and a domain that you don't claim/manage there's no ability to view or change the authentication policy that they impose and whether it includes the MFA/2FA.

So it's possible that these external admins are authenticating using MFA, but it's not something you can control. There's much room for improvement when dealing with accounts for domains you don't (or can't manage) and how they authenticate to your products or admin.

[Antti Salo _Ambientia_]

Thanks for your reply, David - I came to same conclusion myself.

You'd think admin accounts could be protected better than this, so it's a little alarming. After all, if you can get into admin.atlassian.com you probably can at least invite new accounts and handle their product access and group access (for local groups).