Multiple Users Share One Token

Question

A user requested that their team be able to use a single token for authentication.

Isn't this a violation of many security rules; such as SOC compliance.

Kristján Geir Mathiesen · Accepted Answer

Hi @John Welby and welcome to the Community.

I am no SOC expert but this idea is not a good one. Each should have their own token. If you need a "function" to do something, then create a "Service" user (just a regular user except you store the password away) for such tokens.

HTH,
KGM

Nic Brough -Adaptavist- · Accepted Answer

Welcome to the Atlassian Community!

This is an absolute violation of security, you should never share access tokens.

Joe Pitt · Accepted Answer

This is Security 101. If a security audit is done and that comes out whoever approved that may get fired. As the other said it is a total violation of the concept of using two factor authentication which is what security tokens are.