The most dangerous 2FA moment is not a hacker - it is the admin who changed phones and locked themselves out. Here are the recovery routes, in the order you should use them.
Every Jira admin should read this page before enforcement day. It covers how lockouts really happen, and the three recovery routes: a second admin reset, your backup methods, and the last resort vendor route - plus the drill that makes sure you never need route three.
It is never a hacker. It is a new phone without migrating the authenticator app. A reset phone. An authenticator app deleted to free space. Or a single admin who enrolled, enforced 2FA for everyone including themselves, and then lost the one device that held the code. 2FA lockouts are always self inflicted and always preventable - which is why this page exists.
If any other Jira admin can still log in, the fix takes two minutes. That admin opens the miniOrange 2FA settings, finds your user, and resets your 2FA. You log in with your password, enrol again on the new phone, and the crisis is over. This is why the golden rule of this whole series is: never let an instance depend on exactly one working admin login. Create the second admin before the pilot, not after the incident.
If you configured a backup method - email OTP or security questions - use it to get in once, then immediately re-enrol your authenticator properly. Backup methods are not a weakness when they are set up deliberately; they are the fire exit. The fire exit only fails you if nobody built it. Check yours today, while you can still log in.
The worst case: every admin is locked out. Now recovery moves to the server level and the vendor. Stop the self help attempts and do this properly - contact miniOrange support (they handle exactly this scenario for their plugin), and follow Atlassian documented recovery practices for your Jira version if the application itself must be reached. Expect it to take time and expect it to be a story people retell. Then fix the root cause: two admins minimum, backup methods on, enrolment changes rehearsed on a test account first.
The full installation and configuration, done live on a real Jira and Confluence instance, step by step.
Watch Full VideoYes. An administrator who can log in can reset another user 2FA enrollment from the miniOrange plugin settings, and the user enrols again at the next login. This is the normal recovery for lost phones and new devices.
Then recovery leaves the plugin settings. Contact miniOrange support for their lockout procedure and follow Atlassian documented recovery steps for your Jira version. It is slow, which is why the prevention rule is absolute - always keep two working admin logins.
Keep at least two admin accounts enrolled and working, enable a backup method such as email verification, test phone changes on a normal account first, and re-enrol your authenticator immediately whenever you change devices - before wiping the old phone.