Why does Atlassian make user governance so difficult across its platform?

[Neil L]

We chose Jira Service Management as our ITSM solution, but one thing that has become increasingly frustrating is how many “gotchas” exist across the broader Atlassian platform.

Why does everything feel like a separate app or product for sale, especially when some of the most useful capabilities on JSM seem to live in the Marketplace instead of the core platform? (But we expose a well-documented API....) ($$$$ 40billion $$$$) For an admin, it can feel like essential governance and management features are fragmented or sold separately.

A bigger concern is user governance around Atlassian Guard. Why are admins held accountable for Guard user counts when users on a claimed domain, already managed by an IdP, can still sign themselves up for products on their own? That creates a constant Shadow IT cleanup problem where admins have to step in afterward, remove access, and disable accounts. But wait, you can upgrade to Enterprise, and this is solved?! Mr. Crabs - MONEY MONEY MONEY 

It gets even worse with products like Trello and Bitbucket, where management and visibility are nonexistent - sure, you can see when one of your managed users signed up for something because they send you the bill but cannot do anything about it. LOL

So my questions are:

1. What is Atlassian’s intended governance model for preventing unauthorized self-signup across products?
2. Why is there still such a disconnect between claimed domains, IdP control, Guard licensing, and product-level access?
3. Are there any real plans to unify administration across Jira, Confluence, Trello, and Bitbucket in a way that actually helps IT teams stay in control?

[Arkadiusz Wroblewski]

Hello @Neil L 

You’re spot on to call this out.

The current governance model isn't the "kill switch" many admins expect it to be. Even with a claimed domain and a solid IdP setup, Atlassian's philosophy still leans toward visibility rather than absolute restriction.

You get managed accounts and Shadow IT discovery through tools like Guard, but actually stopping users from self-starting products remains a game of whack-a-mole. While you can require admin review for app requests on certain plans, the system still allows users to slip through in specific scenarios, which is exactly why it feels so fragmented.

The split between organization-level controls and product-specific settings especially in Trello and Bitbucket is a real pain point. Jira and Confluence have moved closer to a centralized model, but Trello and Bitbucket often still require you to dive into their individual workspace layers to tighten governance. This "divided house" approach to administration is a frequent topic of debate here.

Regarding the roadmap, keep in mind that as community members, we can't speak for Atlassian’s internal development or their licensing logic.

While they are slowly consolidating more controls into the central Admin hub, the unified experience you're looking for isn't fully here yet. Your best bet right now is to verify if your specific plan is eligible for the advanced Shadow IT controls and ensure you’ve manually tightened every available toggle in the Trello and Bitbucket settings.

It's not the seamless solution we all want, but it’s the most effective way to manage the current state.

[Neil L]

We have the plan under Enterprise. Thank you for the reply, cheers to the future then, hopefully looking forward to these improvements.