2FA for SaaS: Notion, Mailchimp, DocuSign, and Jira (2026)

The modern workday is a row of browser tabs: the wiki, the newsletter tool, the contract, the ticket queue. Each tab is a separate account, and an uncomfortable number of them are held shut by one reused password. Every vendor in that tab bar ships some form of two-factor authentication; none of them puts the switch anywhere you would find it by accident.

The mechanics barely change from service to service, because nearly all of these services speak TOTP — the six-digit, clock-derived codes we explain in our TOTP primer. We have already done the Zoom edition of this tour; this one walks the four tabs people ask about most: Notion, Mailchimp, DocuSign, and Jira, with a short stop at Slack. Same lock everywhere, five different hiding places.

The pattern: account-level, not per-project

SaaS two-factor authentication attaches to the account, not the work. Not per-project, not per-document, not per-workspace — Slack is the partial exception below. Your Notion login, your Mailchimp login, your Atlassian identity: each has exactly one 2FA setting, and it follows the account. The benefit is that one toggle covers every workspace, audience, and board the account can touch; the limitation is that you cannot protect one sensitive project with a second factor while leaving the rest of the account alone.

The second half is enforcement. When a company wants 2FA for everyone, it does not nag; it wires the SaaS to an identity provider and lets the IdP's own MFA become the real door — SAML SSO in Notion's enterprise tier, Atlassian Guard for the Atlassian suite. If your accounts belong to an employer, the admin layer decides; if they are yours, the setting is yours to flip. The third half — this pattern has three halves — is recovery. Backup codes and lost-phone flows differ between these vendors more than the 2FA itself does, and the recovery chain usually runs through your email inbox, which makes 2FA on your Google account the highest-leverage two minutes in this post.

Where Notion hides its 2FA switch

Notion keeps 2FA in a per-account corner of its settings: as of this writing, Settings → My account → 2-factor authentication. You get a choice of SMS or an authenticator app, and the app option is ordinary TOTP — scan the QR code with any standards-compliant authenticator, type back one code, done. Take the app; SMS codes travel through a channel your carrier can be talked into redirecting, and the app option does not.

Two things consistently confuse people here. First, SAML SSO is not 2FA — it is an enterprise-tier feature (check the current pricing page for which tier; Notion reshuffles tiers often) that changes who verifies your login, not whether there is a second factor. With SSO in place, the MFA guarding your sign-in is your identity provider's. Then the classic question: "my workspace uses SSO, so I'm covered, right?" Through that login, yes. But your Notion account — same email, same profile — still carries its own password, still joins workspaces with no SSO, and still gets phished on its own schedule. Personal 2FA costs two minutes and covers every door the SSO does not. Notion's documentation lives at help.notion.com.

Mailchimp: the asset is the audience

Mailchimp 2FA sits behind your profile: click the profile icon and open the Security section — as of this writing the path is roughly profile → Security, though Mailchimp redesigns its admin area often. The feature set has historically been SMS-first: years of text-message verification and a required phone number, with an authenticator-app option arriving later. If your account offers both, pick the app — SMS is the weaker factor, and our guide to how 2FA gets bypassed covers why SIM swaps make a phone number a shakier identity than people assume.

The stakes are specific to what Mailchimp holds. The crown jewel is the audience: an email list with names, addresses, engagement history, and standing consent to hear from you. Stolen lists get resold for phishing, and a list lifted from a trusted sender is better phishing material than most — the attacker writes to people who opted into mail from your domain, referencing real campaigns. Add sending from your verified domain and the sender reputation you spent years building, and the account is worth more than its monthly fee. Mailchimp's documentation starts at mailchimp.com/help.

DocuSign: identity is the product

DocuSign is the odd one on this list because identity is what it sells: a signature means only as much as the assurance that the right person applied it. Login 2FA lives in your account's security settings, reachable from your profile as of this writing, and the supported second factors include an authenticator app (standard TOTP), SMS, and a phone call, with passkeys rolling out across account types — in progress rather than finished, so check what your account offers.

The distinction worth keeping straight is account authentication versus envelope authentication. When you send a document, DocuSign lets you require recipient checks on that specific envelope — an access code, an SMS ID check, knowledge-based verification. Those are per-document controls, not login 2FA in either direction: your account 2FA does not verify your recipients, and an envelope's ID check does not protect the account that sent it. An attacker inside your account gets your templates, your document history, and the ability to send envelopes that look exactly like yours — precisely the phishing scenario the product exists to prevent. Configure both, as separate things; DocuSign's support pages start at support.docusign.com.

Jira, Confluence, Trello: one Atlassian account

Jira does not have its own 2FA, and this confuses everyone: Jira, Confluence, Trello, and Bitbucket all authenticate through one Atlassian account, and the Atlassian 2FA setting you want is called two-step verification. As of this writing you reach it at id.atlassian.com — Security, Two-step verification — or via your profile inside any product. Supported methods are an authenticator app (plain TOTP) and security keys, and enrollment offers recovery codes. Save them like a document titled "things I cannot afford to lose."

The admin side is where Atlassian differs from the rest. Organization admins can require two-step verification org-wide through Atlassian Guard — formerly Atlassian Access, renamed a couple of years back — which also handles the SSO layer for the suite. So the Jira question is really two questions: if your Atlassian account is personal, turn on two-step verification yourself (the documented path starts at support.atlassian.com); if it belongs to a company org, your sign-in experience is whatever Guard enforces.

And Slack, briefly

Slack supports two-factor authentication with an authenticator app — TOTP again — plus SMS for the stubborn. Workspace-level enforcement exists, but as of this writing it is a paid-plan feature: admins on paid plans can require 2FA for some or all members, and free-workspace admins cannot. On a free plan, 2FA is a choice each member makes alone. Slack's documentation lives at slack.com/help.

When the codes don't work

One topic applies to all five services at once: when a correctly typed code gets rejected, the culprit is almost always the clock, not the service. TOTP codes are derived from the time in 30-second windows, so a phone that has drifted off network time generates codes for the wrong window; automatic date and time fixes it in ten seconds. If exactly one service rejects codes while every other accepts them, that service's server clock is off. The field guide is our 2FA troubleshooting guide.

One lock, five keyholes

The reason this roundup is shorter than it looks: every service above enrolls the same way. A QR code, a shared secret, six digits every thirty seconds — the same standard, the same math, interchangeable apps. One authenticator covers the whole tab bar, which is why it is worth picking one you can leave: the vendor who makes enrollment easy today is not automatically the vendor who makes exit easy tomorrow, as anyone who watched Authy retire its desktop apps in 2024 can attest.

To see the standard working before installing anything, the guest generator on this site takes a Base32 secret, an otpauth:// link, or a QR image and shows live codes, computed entirely in your browser — nothing sent, nothing stored. It is a ten-second way to confirm a secret works before committing it to an app.

That is the whole project: five settings screens, two minutes each, done before the coffee cools. The tab bar will thank you, quietly.

Frequently asked questions

Does Notion support 2FA?

Yes, per account. As of this writing the setting is under Settings → My account → 2-factor authentication, with SMS and authenticator-app options — take the app. It covers every workspace the account belongs to, and it is separate from SAML SSO, the enterprise-tier feature that routes workspace sign-in through your identity provider.

Do I need 2FA if my workspace uses SSO?

Usually, yes. SSO governs sign-in to the workspace that enforced it, through the identity provider's own MFA; your underlying account keeps its own password and 2FA setting, and can belong to other workspaces and get phished on its own. Account-level 2FA covers the doors the SSO does not, and it costs about two minutes.

How do I enable 2FA on Jira?

Through the Atlassian account, since Jira, Confluence, and Trello share one login. The setting is called two-step verification: as of this writing, sign in at id.atlassian.com, open Security, and start two-step verification, then scan the QR code with any TOTP authenticator and save the recovery codes. If your account sits in a company org, an admin may have already required it through Atlassian Guard, and enrollment happens at your next sign-in.

Is DocuSign 2FA the same as the ID check on an envelope?

No. Envelope ID checks — access codes, SMS verification, knowledge-based questions — authenticate the recipient of one specific document. Login 2FA protects the account that sends envelopes: your templates, your document history, and your ability to send mail that looks like it came from you. Both are worth configuring, and neither does the other's job.

Can an admin force 2FA for everyone on these services?

On paid plans and enterprise tiers, generally yes: Slack workspace admins on paid plans can require two-factor authentication for members, Atlassian org admins can require it through Atlassian Guard, and Notion's enterprise SSO pushes authentication policy to the identity provider. Free tiers usually leave 2FA a personal choice, which means the only admin who can enforce it is you.