Short answer: Atlassian accounts are managed at id.atlassian.com → Security, where you can turn on two-step verification and add an authenticator app. One Atlassian account covers Jira, Confluence, Bitbucket and Trello, so you set this up once. If your company manages your account through an identity provider, 2FA is enforced there instead — and administrators can require it for everyone from the Atlassian admin console.
One account, several products
This is the thing worth understanding first. Your Atlassian account is a single identity spanning Jira, Confluence, Bitbucket, Trello and Atlassian’s other tools. Secure it once and everything is covered.
It also means one compromise reaches everything: your issue tracker, your internal documentation, your source code, and your project boards. For a software team, that is close to the whole operation. If some of your documentation lives outside Atlassian, apply the same thinking to two-factor authentication on Notion.
Bitbucket deserves separate mention. Source code access is not just intellectual property — repositories routinely contain credentials, API keys and configuration that lead somewhere else. A code repository breach is often the first step rather than the last.
Step 1: Turn on two-step verification
- Go to id.atlassian.com and sign in.
- Open the Security tab.
- Find Two-step verification and turn it on.
- Confirm your password.
- Scan the QR code with your authenticator app and enter the six-digit code.
Any standard TOTP app works — Google Authenticator, Aegis, 2FAS, Microsoft Authenticator, or a password manager. New to this? What is an authenticator app. If the QR will not scan, use manual key entry.
Do not screenshot the QR code — it contains the raw secret, and engineering teams screen-share constantly (what’s inside a 2FA QR code).
Atlassian gives you a recovery key at the end. Save it offline — see backup codes vs recovery keys.
Step 2: If your account is company-managed
If your organisation has verified its domain, your account may be managed, and authentication may run through Google, Microsoft or Okta via SAML. In that case the two-step verification option may be absent or overridden, and your security lives at the identity provider.
That is generally the stronger arrangement — see what is single sign-on and, for the Google side, enforcing 2FA in Workspace.
Step 3: For administrators — enforce it
In the Atlassian admin console (admin.atlassian.com), under Security → Authentication policies, you can require two-step verification for all managed accounts.
Practical rollout:
- Create a policy and apply it to a small group first.
- Announce the change with a one-page guide.
- Extend to everyone with a grace period.
- Review the members list and remove people who have left.
Also worth configuring: session duration limits, and idle session timeouts. A long-lived session is a standing bypass of your authentication policy — see session hijacking. The wider rollout pattern is in 2FA for small teams.
Step 4: API tokens — the part that bypasses everything
Atlassian API tokens and Bitbucket app passwords authenticate without any 2FA prompt. So does an SSH key on Bitbucket.
- Review your API tokens at id.atlassian.com → Security → API tokens. Revoke anything you cannot account for.
- Set expiry on tokens where the option exists, and rotate them periodically.
- Scope Bitbucket app passwords narrowly — read-only where that suffices.
- Audit SSH keys on Bitbucket and remove keys belonging to machines you no longer use.
- Rotate anything that has been on a departed colleague’s laptop or in a CI system you have replaced.
The same principle applies at Cloudflare, Stripe and AWS: tokens are a parallel credential system, and securing the login does nothing for them.
Step 5: Trello-specific and third-party apps
- Trello public boards. Boards set to public are indexed by search engines, and internal information has been exposed this way repeatedly. Check the visibility setting on every board — this is a bigger practical risk than account takeover.
- Marketplace apps and Power-Ups — each holds scoped access to your data. Remove what you do not use, and require admin approval for new installs where possible.
- Connected accounts — Google, Microsoft or Apple sign-in links. If any can authenticate as you, that account’s security is now yours.
- Guest access in Jira and Confluence — review external collaborators periodically.
Frequently asked questions
Does one setup cover Jira, Confluence and Trello?
Yes. They share your Atlassian account, so two-step verification applies across all of them.
Does Atlassian support security keys or passkeys?
Atlassian has been expanding passwordless and passkey support. If the option appears in your security settings, take it — it is phishing-resistant in a way TOTP is not. See passkeys vs 2FA.
Why can’t I enable two-step verification?
Your account is likely managed by an organisation using SSO, so authentication is handled upstream.
Why is my code rejected?
Usually clock drift on your phone. Turn on automatic network time — why 2FA codes get rejected.
What if I lose my phone?
Use the recovery key generated at setup. On a managed account, an administrator can reset your two-step verification. See recovering accounts after losing your 2FA phone.
Will enabling 2FA break my integrations?
Integrations using API tokens continue working — that is precisely why auditing them matters. Anything using your raw password will break, which is a good prompt to move it to a token.
The bottom line
One account covers all the Atlassian products, so this is a five-minute job with broad reach. The larger task is the token audit: API tokens, app passwords and SSH keys authenticate without ever meeting your second factor, and for a development team that is where the real exposure sits. Check Trello board visibility while you are at it.
Securing the rest of the toolchain? See GitHub, GitLab and Slack. Designers on the team should also read our guide to 2FA on an Adobe account.