Summary

Currently, the available two-step verification methods appear to be an authenticator app, a security key, or SMS.

User Problem

When users need to create a break-glass account, it must exist outside of SAML SSO and have MFA enabled for added security. I many cases, the admin team is composed of multiple teams, and each person needs to be able to access the break-glass account. Therefore, we are looking for an MFA method other than using shared TOTP via an Enterprise Password Manager or PAM Vault, and the use of Multiple Hardware Security Keys, that would help them meet this requirement.

Suggested Resolution

After entering their credentials, the user would receive a one-time verification code by email and would need to enter this code to complete the login. This verification would be performed at every login.

Current Workarounds

• Dedicated Authentication Policy in Atlassian Guard - Requires access to the same device for MFA when the account is shared.
• Shared TOTP via an Enterprise Password Manager or PAM Vault
• Multiple Hardware Security Keys - Requires the distribution of security key devices.