Unexpected 2FA Prompt for Non-Enrolled User + Domain Verification Concerns

[i_onum]

Hi Community,

We recently encountered an issue where a user was unexpectedly prompted for two-factor authentication (2FA) despite never enrolling or activating it. As a result, the user was unable to access both Jira and Confluence.

We have noticed that our domain has not yet been verified in Atlassian Admin which we are not looking at doing just now because we’re unsure of the security implications or potential changes for all users authentication behaviour once domain verification is completed.

I would appreciate guidance on the following:

• What could trigger a 2FA prompt for a user who has not enabled or enrolled in 2FA?
• Are there known scenarios or configurations that cause this behaviour?
• What are the best practices to prevent such access issues without compromising security policies?
• What are the implications of verifying our domain, particularly in relation to user authentication and account control?

Thanks.

[marc -Collabello--Phase Locked-]

It is quite common for Atlassian to ask users to start using 2FA (i.e. setup).  However the screen shot you showed implies that the user has already set up their 2FA.

[i_onum]

if you look at the second screenshot, you will see that the 2FA is not setup for the user am just surprised why. Do you think that verifying my organisation domain would help in fixing this issue.

[marc -Collabello--Phase Locked-]

Normal user accounts are independent of the specific Atlassian instance you use.  Maybe someone in another Atlassian instance required the user to use 2FA.  This 2FA selection will then automatically apply to your Atlassian instance for this user.