Enable 2FA in Jira & Confluence with miniOrange

Know What You Are Installing

Self-hosted Jira and Confluence do not ship with a full two-factor enforcement system for every user out of the box, which is why this video uses the miniOrange two factor authentication app. Be clear about what that means before you start: miniOrange is a third-party vendor plugin, not a feature built by Atlassian, and it is installed separately in each application.

You need administrator rights on the Jira and Confluence servers to do this, and the Jira install and the Confluence install are two separate jobs — finishing Jira does not switch anything on in Confluence.

Install the miniOrange 2FA App

From the app management area of the Jira admin console, find the miniOrange two factor authentication app on the Atlassian Marketplace and install it. Marketplace apps install inside the product itself, so there is nothing to download to your PC and nothing to copy onto the server by hand.

Once Jira is done, repeat the same install inside Confluence. Only continue to configuration when the app shows as installed in both applications.

Configure TOTP as the Second Factor

In the app configuration, choose TOTP as the second factor. With TOTP, each user enrolls once with an authenticator app on their phone: at setup the user scans the code shown on screen with the authenticator app, and from then on the app generates a fresh, short-lived code for every login.

The login flow your users will see after this is simple: username and password first, then the current TOTP code from the authenticator app. Configure this before moving on — enforcement settings come later, after the pilot.

Save Recovery Codes Before Enforcing Anything

Before 2FA becomes mandatory for anyone, every user — and the administrators first of all — must generate their recovery codes and store them somewhere safe outside the server, for example printed and filed, or in a password manager.

Roll Out to a Pilot Group First

Do not switch 2FA on for the whole company at once. Enable it first for a small pilot group — your own IT team is the natural choice — and have them use it for real work.

Have the pilot group test the complete journey: logging in with password plus TOTP code, enrolling a new phone, and getting back in with a recovery code. Every problem you find here is a problem you have fixed while only a handful of people are affected, instead of the whole office on a Monday morning.

Use the Grace Period, Then Enforce

Once the pilot is clean, announce a deadline to all users and start the grace period: for a set window, users are prompted to enroll in 2FA at login but can still get in while they set it up. Communicate the date plainly — what is changing, by when, and where to ask for help.

When the grace period ends, enforcement begins: nobody logs in to Jira or Confluence without the second factor. Because the pilot already proved the flow and the grace period gave everyone time to enroll, enforcement day should be quiet.

Keep Admin Recovery Ready

Phones get lost, replaced and reset — treat lockouts as a normal event, not an exception. The admin recovery path is how an administrator resets a locked-out user’s second factor so that user can enroll again fresh at the next login.

Keep this recovery route documented and tested even after enforcement is complete, and re-check it whenever the app is updated. A 2FA system whose recovery path nobody has tried is a lockout waiting to happen.