Enforcement day does not have to be a helpdesk disaster. A grace period - reminders first, hard requirement later - is the small setting that makes the whole rollout boring, in the good way.
Switching 2FA from optional to compulsory in one jump is how admins lock out half the company. This guide covers the grace period: how it works in the miniOrange setup, how long to give, and how to handle the people who miss it anyway.
A grace period is the space between 2FA is available and 2FA is compulsory. During it, users who have not enrolled are reminded at login and offered setup, but can still get in a limited number of times or for a limited number of days. It exists for one reason: people are on leave, in travel, in meetings - life does not stop for your security project. The grace period absorbs all of that quietly.
However good your grace period is, a few users will hit the wall on enforcement morning: the person back from three weeks of leave, the contractor who logs in monthly, the executive whose assistant handled everything. Plan the response in advance. An admin resets or temporarily adjusts their 2FA from the plugin settings, they enrol on the spot, and the incident is over in minutes - if an admin is reachable and the procedure is written down.
Enforcement ordering matters. Admins and IT enrol first, fully, with backup methods tested - days before general enforcement. If your only admin discovers a problem with their own 2FA on the morning everyone else is locked to compulsory mode, you have built a lockout with extra steps. Admins first, grace for everyone else, and the recovery route rehearsed before it is needed.
The full installation and configuration, done live on a real Jira and Confluence instance, step by step.
Watch Full VideoFor most teams a few days to two weeks is enough for regular staff. Give administrators no grace at all - they enrol first. Very occasional users like monthly contractors should be chased personally instead of extending the whole grace period.
Users who still have not enrolled must complete 2FA setup before they can reach Jira - there is no skip left. Anyone genuinely stuck is fixed by an admin resetting or adjusting their 2FA from the miniOrange plugin settings.
Yes - announce the date when the grace period starts, with the setup steps attached and a reminder halfway through. Surprise enforcement is the single most common cause of rollout anger.