Prevent team member access requests

Question

Occasionally we get attackers sending team member access requests.

How do we disable the mechanism for requesting access? I want to ensure that no user accidentally approves a request from a look-alike phishing domain or similar. We only want to add employee access manually.

I know that each admin can turn off notifications individually, but we don't want another thing to audit. This also doesn't appear to help with eg., the Slack integration.

Stephen Sifers · Answer

Hello @Brian McGroarty

Just a reminder there is an outstanding support request for you on this; https://getsupport.atlassian.com/browse/SPSP-20212.

Regards,
Stephen Sifers

Stephen Sifers · Answer

Hello Brian,

I did some further investigating of your issue and did find your statuspage does have an inactive page which allows anyone to click a link to request access, see screenshot:

I'll go ahead and submit a support request on your behalf (We'll need confirmation to remove the inactive site/URL), I'll include your site's main contact as well for approval.

You should be getting an email from support shortly.

Regards,
Stephen Sifers

Brian McGroarty · Answer

We're already configured with our own domain as the only entry under "Approved domains" and "Access Requests" is configured as "New users can't request access."

Even with these settings, we get periodic requests similar to the below for StatusPage. I suspect StatusPage isn't honoring this setting, unlike the other Atlassian products:

Hey there,

We received a request from (redacted)@gmail.com to help manage your status page, and creating an account for them is just a click away.

Click here to add this person to your team.

If you do not know who this person is, please ignore this email.