The difference between a smooth 2FA rollout and a company wide lockout is one small pilot group. Here is how to run it with the miniOrange app group settings.
Every failed 2FA rollout shares the same mistake - everyone was switched on at once. The miniOrange app can target groups, so use that power. This guide runs the pilot stage properly: who goes first, what you are really testing, and when you are allowed to go wider.
The miniOrange 2FA app lets you enable 2FA for specific users or groups instead of the whole instance. Create a group for the pilot - call it something obvious like 2fa-pilot - and enable 2FA for that group only. Everyone else logs in exactly as before while you learn.
The pilot is not testing whether the plugin works - it does. It is testing your instructions, your support load and your edge cases. Does everyone have a phone they can use. Does the code arrive fast enough. Does anyone use a shared workstation. Does the CEO assistant log in as someone else - a habit 2FA will end, and you want to discover that in the pilot, not on enforcement day.
Keep a simple list during the pilot: what confused people, how long setup took, what broke. Every repeated question becomes a line in your announcement to the rest of the company. If the pilot group needed five minutes each, tell the company five minutes. If one department has no phone signal in their office area, you have just found your hardware key users - before it became an emergency.
After a few working days, decide honestly. Go wider only when pilot users log in without help, your reset procedure has been used at least once and worked, and at least one admin has practised resetting a user 2FA. If any of those failed, fix it and extend the pilot. A delayed rollout is a story for a week. A company wide lockout is a story for a year.
The full installation and configuration, done live on a real Jira and Confluence instance, step by step.
Watch Full VideoFive to ten users is plenty - your IT team plus a few cooperative users from other departments. Include at least one person who is not technical; if they can enrol without help, your instructions are good enough for everyone.
A few working days of normal use. Long enough for everyone to log in several times, for at least one reset to happen, and for the daily edge cases like shared workstations to appear.
Yes. Group based and per user enablement is a core feature of the miniOrange 2FA apps for Jira and Confluence, along with the ability to restrict which methods each group may use. That is what makes a staged rollout possible.