When One JSM Ticket Turns Into a Tenant Takeover 😲

[#1]

...aka The Curious Case of Accidental Atlassian Explorers

Jira Service Management (JSM) is an absolute game-changer. It’s clean, powerful, and just… works. ✅

But once your JSM instance is live and out in the wild — especially when exposed to external customers — something a little funny (and a bit chaotic 🌀) starts happening.

Let me explain. 👇

📝 It All Starts with a Simple Support Ticket

You open up your portal. Hundreds (maybe thousands) of customers or partners start using it. Great!
But then, almost immediately, your inbox begins to fill with emails like:

📨 "John would like to access Jira Software, Confluence, Product Discovery, and Jira Service Management." ("John tried to access everything — even Product Discovery, which we weren’t even using yet!") 

Wait, what? 😅 They only submitted a support ticket — why are they now requesting access to everything?

Welcome to the World of Accidental Atlassian Exploration

Once JSM is live and publicly accessible:

• A user submits a ticket or logs in to check status.
• Then curiosity kicks in: “What else is here?”
• They enter the base URL (yourcompany.atlassian.net)
• They land on Jira Software.
• Then they poke into Confluence.
• Then Product Discovery
• Then they request access to everything. In one go.

It's never just a request for one product. It’s always a bundle. They want the full ride pass for the Atlassian Park.

🤔 Why This Happens

This isn’t bad behavior — it’s actually just how the Atlassian ecosystem works:

• If your support portal is open to the public, anyone can get the URL.
• The “Request Access” button is way too tempting — and easy to trigger by accident.

🛠️ Admin Life: Fun, Frustrating, and Forever Full of Requests

As an admin, I’m now used to this. I know the pattern.

But I’m still amazed every time someone manages to "discover" all these tools on their own.
They weren’t trying to overstep. They just followed curiosity… and maybe a few URLs.

Have You Seen This Too?

This actually happened to me today again. Anyone else living this admin life?

Have you had a moment where one JSM user ended up trying to join your entire Atlassian stack? Have you found a good way to gently guide users back to just the portal?

Would love to hear your stories — or hacks you’ve found helpful.

Bonus Tips for Fellow Admins 🚫🧹

• Restrict product access by default — don’t auto-approve just because a domain matches.
• Clean up zombie users regularly — those “Request Access” clicks create clutter.

Have you had a "tenant takeover" moment?

[Hayley Skelton]

An article after my own heart! This happened so often in our space that we ended up turning the request option off 😅 It wasn't helpful for us anyway as our Projects aren't open by default, so access always required an additional action

[Calvin]

We get this all the time working in IT which I know a lot of us are. You just get people who want everything, and they want admin access to it all too.

We've changed this process around though, any new user has to fill out the official form on our Jira Service Management Portal via an official Service Request. 

This ensures its transparent and accountable ticket and allows it go through any approval process and review of actual need as opposed to "someone whose curious and just wants it all"!

This is especially helpful when someone "wants a product because it sounds good" without them even knowing what it is and how it will impact the production environment.

It also makes it easier for the team as it means all other requests can be ignored if it isn't via the official JSM Portal Form.

[Robert Nadon]

You think that is bad.   Try being a Professional services partner.  I am org admin of about 100 different sites and get innundated with John wants to try..., and Jane was added to...  I probably get 30 a day, EVERYDAY. 

What happens is after the engagement is over they do not remove us from the systems, and unfortuneately in Atlassian, an org admin can remove everyone but themself...

[Justin Racklin]

I get these all the time from users that somehow get misrouted to setting up an Atlassian account (and they were getting added as agents in JSM until I realized what was going on; saved a lot of money once we eliminated that agent licenses) even though they already have a Portal-only user account.  For some reason, even though my users have portal-only accounts, clicking on the links in the e-mails for their tickets sometimes wants them to create an account instead of logging into their existing portal-only account.  At this point, even from the same domain, no one gets access unless I or another Org Admin say so.

[Rishabh Jhawar]

@Hayley Skelton 

Absolutely! I always recommend that access requests be confirmed only after an additional manual action.

Glad to hear you could relate to this! 😊

[Rishabh Jhawar]

@Calvin 

Thanks for sharing — that’s a solid approach!

That's a solid way to funnel everything through an official JSM request form.

Appreciate the insight — People might just borrow this process!

[Rishabh Jhawar]

@Robert Nadon 

That’s next-level admin chaos. 😅
I’m honestly wondering if it’s worth reaching out to Atlassian support to see if they can help remove you from some of those tenants.

Also, the fact that org admins can’t even remove themselves is such a strange limitation. You end up stuck in places long after the work’s done. Definitely feels like a feature that needs some love. 

[Rishabh Jhawar]

@Justin Racklin 

Glad you caught the agent license issue early — that can turn into a silent budget drain real fast.

I’ve always believed access requests should only be granted after an explicit manual action — never automatically.

[Dave Liao]

@Robert Nadon - agree with you! I found ID-8144 and ID-8572... I feel like there should be an overarching ticket, and surprised there aren't more votes for those suggestion tickets... 🫠

@Rishabh Jhawar - good reminder for us admins to restrict product access by default. We should be intentional with all things, including access!

It's way too easy for users to make requests, especially by accident. Or to make requests others in bulk via Slack ... 😭 https://jira.atlassian.com/browse/JRACLOUD-78922

[Rishabh Jhawar]

@Dave Liao 

I’m glad that my "This" tenant is not integrated with Slack — otherwise, these bulk blunders could have caused major issues.

These tickets certainly needs more votes... those capabilities are needed now.