2FA on Atlassian Account vs. 2FA on Bitbucket, and enabling globally

[pml]

Hey!

I have 2FA enabled on my Atlassian account. The only Atlassian product my org currently uses is Bitbucket, and when I log into bitbucket via my Atlassian account I'm required to use my @FA credential in addition to my password, which is great. I can see that I have 2FA enabled on my account at https://id.atlassian.com/manage-profile/security

I'd like to force our bitbucket workspace to make all users use 2FA if they want to log in. However, I can't do this because Bitbucket tells me that 2FA isn't enabled on my account.  This is true - if I go to https://bitbucket.org/account/settings/two-step-verification/ I see that I don't have 2FA enabled on my bitbucket account.

I have several questions arising from this:

1) How do I force all users to use 2FA when logging into bitbucket?

2) Will doing 1) force me to change how I log into Bitbucket and what credential I use?

3) Will doing 1) force me to change how I log into my Atlassian account and what credential I use?

4) What is the distinction between these two accounts?

[Shwetha Suvarna · Accepted solution]

Hi @pml 

 Welcome to Community...

Enforcing 2SV in Bitbucket is part of the Premium Plan of Bitbucket. You can find all the features of our premium offering in the documentation below :

https://bitbucket.org/product/premium

Query 1 :  How do I enforce 2Fa to all users within the workspace

If the workspace is in Premium plan, you can follow the below steps

• Go to Workspace settings--> Access Controls → Check Require two-step verification
• This will enable two-step verification for all users accessing the workspace.
  
  

Query 2 : Will doing 1) force me to change how I log into Bitbucket and what credential I use?

When you enable this option for your team, users will need to have two-step verification enabled in order to interact (view, push, clone, etc.) with your account’s private content: repositories, team settings, issue trackers, wikis, and snippets.
If a user doesn’t have two-step verification enabled at the time of access, they’ll see instructions on how to enable two-step verification in the UI and continue.

• The users first log in with their Atlassian Email address and Password.
• Second Authentication is with the Authentication code received via the verification app on the Mobile device. Example Authy, Google Authenticator, or Duo
• More details on the page : https://support.atlassian.com/bitbucket-cloud/docs/enable-two-step-verification/

Query  3 : Will doing 1) force me to change how I log into my Atlassian account and what credentials I use?

No, there will be no change when you log into your Atlassian account or other Atlassian products.

Query 4 : What is the distinction between these two accounts?

• BitBucket Two-step verification secures your account by requiring a second confirmation, in addition to your password, to access Bitbucket Cloud only.
• Atlassian Multifactor Authentication  protects your Atlassian account by requiring a second login step. This applies to all Atlassian Cloud products like Jira, confluence and other apps.

I hope this helps.

Best Regards

Shwetha Suvarna

[pml]

Hey! Thanks for the speedy response. This provides some clarification, but I'm still confused about how my access is changed. I have BitBucket OTP on on my account now, so I now have two MFAs: one for BitBucket, and one for Atlassian. I have (as far as I am aware) no actual password for my BitBucket account, since I only connect via Atlassian: my BitBucket MFA is just kind of floating in space, inside of my passmanager.

1) I go to BitBucket, which tells me to log in.
2) The login asks me to login with my Atlassian account, so I do so, using my Atlassian account, password, and MFA. (This is as you suggested in response to my third question above.)
3) I am now in BitBucket. The BitBucket MFA is never used.

What is the BitBucket MFA for, if I'm only using the Atlassian MFA? 

[pml]

Ah! It seems something was cached in my browser. I visited another link to BitBucket and was immediately asked for a BitBucket OTP. Redundancy (two working MFAs) seems just fine.