Disable 2FA for End User
Asked by Md Miah:

Hello,

We are working on enabling MFA for end users. However, I can't find an option to disable MFA for a user by logging in as admin. How can I disable MFA for a user when the user does not have access to their phone or recovery key?

Please note that I have followed the below steps:

1. From your organization at [admin.atlassian.com](http://admin.atlassian.com/), select **Security** \> **Authentication policies** .

2. Move member to a policy where two-step verification is optional.

3. Select **Directory** \> **Managed accounts** \> **Show details** to open the member's page.

4. Select **Disable two-step verification** so the member can reset two-step verification and log in.

5. Move the member back to the previous policy.

However, when I click on "show details", it does not give me the option to disable MFA.

Please advise.....

Thanks

Md


Answers:
author: Mahmoud Aldamiri
body: we are facing this issue currently and the user is not able to login what to do in this case while the administrator does not have the right to disable the 2 steps auth   

the user forgot to save the key and lost his phone, Does anyone have a solution?  


author: Kristin Lyons
body: Can you add a screenshot of the two authentication policies?

comments: author: Md Miah
body: ![Screenshot 2021-12-22 094625.png](https://community.atlassian.com/t5/image/serverpage/image-id/175079i155EAA0EA0A7CD89/image-size/large?v=v2&px=999 "Screenshot 2021-12-22 094625.png")


author: Md Miah
body: FYI: We do not have the access subscription to create another authentication policy. We can only have one policy.


author: Kristin Lyons
body: It's my understanding that to require MFA, you need an Atlassian Access subscription - is it possible that the user has set their own account to require it? The user can go to this page <https://id.atlassian.com/manage-profile/security/two-step-verification> and see if they have it enabled or disabled and can control whether to require it or not.


author: Md Miah
body: We will enable it per user by giving them the url you shared. However, we want to know if the admins can disable the MFA or give them temporary urgent access if needed?


author: Kristin Lyons
body: Admins cannot disable MFA if the user has it configured. Only the user would be able to disable it.


author: Md Miah
body: Ok, but it is required to have the MFA code to be able to disable the MFA prompt. However, what if the user loses their phone or in case of an emergency when the user does not have access to their phone?

Thanks

Md


author: Kristin Lyons
body: [@Md Miah](/t5/user/viewprofilepage/user-id/4682363) There is information on this page that answers that question - <https://support.atlassian.com/atlassian-account/docs/manage-two-step-verification-for-your-atlassian-account/> the user will get a backup code that they need to save.


author: ANNA.ROZANEK
body: my recovery key is not working  
my authenticator is enabled on not working phone  
recover account button showing "unexpected error"

to raise a ticket to IT Support I have to be logged in

to disable 2FA or to disable a mobile device with an authenticator I have to be logged in

Can someone help?


Tags: atl-gruland

cloud

confluence-cloud