The miniOrange app offers many ways to prove it is you - authenticator codes, hardware keys, push, email, SMS. They are not equal. Here is the honest ranking and the mix that suits most teams.
Turning on 2FA is step one; choosing which methods to allow is where security is actually decided. This guide grades each miniOrange method plainly - strengths, named weaknesses, and who should get which.
The authenticator app method (TOTP) generates a six digit code from a shared secret and the time, changing every 30 seconds. It works with no network, costs nothing, and every phone can run Google Authenticator, Microsoft Authenticator or the miniOrange authenticator. In the miniOrange configuration this is the method to enable first and offer to everyone. Its honest weakness: a user can be tricked into reading a live code to a fake support caller - training, not technology, is the fix.
Hardware security keys such as YubiKey are the strongest option the miniOrange apps support - the key will not produce a response for a fake login page, which kills real time phishing. The honest costs: a key per person, money per key, and a spare key policy for losses. The sensible pattern is keys for administrators and high risk roles, TOTP for everyone else.
Push approval is the easiest login experience - tap approve and you are in. Its risk has a name: approval fatigue. A user spammed with prompts eventually taps yes to make it stop, so push works best where prompts are rare and expected. Email OTP is the weakest of the respectable methods - it depends on the mailbox, which is itself protected by a password. Keep email as the backup and recovery method, not the front door.
SMS codes feel friendly because everyone knows text messages. They are also the method with a named attack against them - SIM swap, where an attacker convinces a carrier to move the number. If your team includes users with no smartphone, SMS may still be the bridge that gets them covered, and covered by SMS beats not covered at all. Just do not present it as equal to the others, and move those users to a hardware key when you can.
The full installation and configuration, done live on a real Jira and Confluence instance, step by step.
Watch Full VideoAny standard TOTP app works with the miniOrange setup - Google Authenticator, Microsoft Authenticator and the miniOrange authenticator app are all common choices. Pick one, name it in your announcement, and give users the exact app name so nobody installs a fake lookalike.
For most teams, keys for administrators and high risk roles plus TOTP for everyone else is the sweet spot. Keys for the whole company is stronger but the cost and the lost key logistics rarely pay off outside regulated environments.
Yes, clearly - a SIM swap attack is targeted and uncommon, while password reuse is everywhere. Offer SMS where it is the only workable option, label it honestly as the weakest method, and plan to move those users to a key or app later.