If your Jira lives on atlassian.net, stop before you buy anything. Atlassian accounts already include two step verification - here is how to switch it on, and the one real gap where a plugin still makes sense.
This page exists to save you money. The miniOrange plugin route in this series is for self hosted Jira and Confluence. Cloud is a different world - the second factor is built into the Atlassian account itself. Here is the honest split, and the one exception worth knowing.
On Jira Cloud and Confluence Cloud, nobody logs in with a local Jira password. Users sign in with an Atlassian account, and Atlassian accounts support two step verification that the user enables on their own account. Organisation admins can go further with an Atlassian subscription and require two step verification for managed accounts, and single sign on through an identity provider brings that provider MFA with it. In short - the protection this whole guide series builds with a plugin is already included in Cloud, run by Atlassian.
miniOrange does sell Cloud related 2FA too, and there is one honest niche for it: Jira Service Management portal customers. Portal only customers are not full Atlassian accounts, so organisation MFA policies do not reach them, and miniOrange offers an app that adds 2FA for those portal logins. If your exposure is external customers on a service portal, that is a real gap worth closing. For your own staff on Cloud, it is not - their Atlassian account settings already cover it.
atlassian.net, you are on CloudPlenty of companies run both: Cloud for new teams, a Data Center instance that has not migrated yet. Then you need both answers at once - Atlassian account enforcement on the Cloud side, and the miniOrange plugin on the Data Center side - with one announcement that tells each group which instruction applies to them. Mixing the instructions up is the only real danger, and it is a writing problem, not a technology problem.
The full installation and configuration, done live on a real Jira and Confluence instance, step by step.
Watch Full VideoEach user enables it in their Atlassian account security settings. Organisation admins with the appropriate Atlassian subscription can require it for all managed accounts instead of relying on each user, and SSO through an identity provider applies that provider MFA automatically.
Not fully - portal only customers are not managed Atlassian accounts, so organisation MFA policies do not reach them. That gap is exactly what miniOrange Cloud 2FA app for portal customers is sold for, and it is the legitimate Cloud use case.
Cloud instances use an address ending in atlassian.net and are updated by Atlassian automatically. Data Center runs on your own servers or your own cloud account, and your admins apply the updates. If you installed Jira yourself, it is not Cloud.