The design logic behind of unmanaged/self-managed users taken as External users

[Yong Yang]

Hi guys,

When I firstly see the external users under Security top menu, I guess this is for users not in this organization. In my case, I haven't verifed my company's domain or claim its accounts. So the employees in my company as taken as external users too, which seems not so good.

After thinking, I can understand that Atlassian suggests that every company firstly verify the company domain and claim its email accounts. Through doing this, the company can distinguish internal employess (managed accounts) and other external users.

Then, what if the company doesn't have any domain? My employees are taken as external users.

Let's discuss it if you're interested to this topic.

Thanks,

YY哥

[Rodolfo Romero - Adaptavist]

I'd like to start by adding some context to the User Management process for Atlassian Cloud Products. When a person creates an account with any email address to use any of the Atlassian Products, this account is created in Atlassian's Identity Provider (IdP). Due to GDPR regulations, any account created in the Atlassian IdP belongs to the end user so that they can change their password, name, and other information they might want to share with the world.

Now, when a company wants to be able to manage their employees account, this causes some issues as the management level of user accounts is very limited by default. Here is where the account claiming comes into place.

Claiming accounts is telling Atlassian that certain accounts in their IdP belong to the company. However, a company needs to verify in some way that the accounts are theirs. That's where the domain ownership claim comes into place.

Let's say that ACME Co. is. a company and as any reputable company, they register the domain acme.com. This registration will be configured in a DNS and email addresses will follow the pattern firstname.lastname@acme.com, or something similar. When the company goes through the process of claiming domain ownership with Atlassian, is telling them that any @acme.com accounts are owned by them.

After the domain ownership is completed, ACME Co. can proceed to claim all the accounts and this process will allow the company to have more account management features, such as password complexity, MFA, etc.

This is the recommended approach in all cases, if managing employees accounts is important for the company.