Your Jira and Confluence hold project plans, documents and customer data behind single passwords. Here is how to add a real second factor with the miniOrange app - piloted first, enforced gently, with a recovery path ready.
One leaked password should never hand an attacker your entire Jira. This guide enables two factor authentication on self hosted Jira and Confluence using the miniOrange 2FA app - the same setup shown in the video - in the order that keeps a rollout calm: prepare, install, test on yourself, pilot, then enforce.
A Jira instance is not just a ticket tracker. It holds your project roadmaps, internal discussions, file attachments and - in Confluence - your company runbooks and documentation. All of that is currently protected by one password per person. Passwords get reused, phished and leaked in unrelated breaches. Two factor authentication means a stolen password alone is no longer enough to get in.
Self hosted Jira and Confluence (Server and Data Center) do not include built in 2FA in the base product, which is why a Marketplace app like the miniOrange 2FA app exists. The full walkthrough of the app, on a live instance, is in the video above.
The app is a paid Marketplace app, licensed per user like most Atlassian apps - check the current pricing on the Marketplace listing before you budget, because it changes with your user tier.
Open the miniOrange 2FA configuration inside Jira administration. For most teams the right first method is TOTP - the time based code from an authenticator app such as Google Authenticator, Microsoft Authenticator or the miniOrange authenticator app.
The miniOrange app can enable 2FA for individual users or for whole groups - use that. Create a small pilot group, ideally your IT team plus two or three patient users from other departments.
Nobody should ever be surprised by a 2FA prompt at 9 AM on a Monday. Announce the date, send the setup steps in advance, and be available on the first morning.
Enforcement day is where rollouts usually go wrong. Give users a grace period - a few sign ins or a few days where they are reminded but can still get in and finish setup. After the grace period, 2FA becomes compulsory.
Two safety rules matter more than anything else in this step. First, enrol your own admin account and keep a second admin account ready before enforcement starts. Second, know the recovery route before you need it - an admin can reset a user 2FA from the plugin settings, so one working admin login is your way back in for everyone. The locked out admin case has its own full guide in this series because it deserves one.
The full installation and configuration, done live on a real Jira and Confluence instance, step by step.
Watch Full VideoSelf hosted Jira and Confluence on Server or Data Center do not include 2FA in the base product, which is why admins use a Marketplace app such as the miniOrange 2FA app or put the applications behind single sign on with MFA at the identity provider. Jira Cloud is different - Atlassian accounts there support two step verification managed by Atlassian.
No. It is a paid Atlassian Marketplace app with a trial period, licensed per user in the usual Atlassian tier model. Install the trial first, run your pilot group on it, and only buy licences once the rollout is proven. Check the current price on the Marketplace listing because tiers and prices change.
An administrator can reset that user 2FA enrollment from the miniOrange plugin settings, and the user enrols again on the new phone. This is exactly why at least one admin account must always stay working - keep a second admin ready and enrol admins carefully before enforcement day.