Disabling External User Access

Question

We are preparing to implement user provisioning via Okta, and as a result, we want to completely disable any way for users to log in with any email other than the one tied to our Okta SSO.

For example, users can log in with username@mycompany.com with Okta SSO, but any other email will be rejected out of hand.

Right now there seems to be an out-of-box access policy that pretty much lets people sign up with any email address they want.  This access policy is marked as a “Default” right next to our Okta policy which confusingly is also labeled “Default”

Mikael Sandberg · Answer

No, but you can control that under Products > User access settings where you can add approved domains and then set what users get access to.

Alex Billings · Answer

Thank you for the clarification.  Is it possible to create a policy that is just a blanket deny in this case?

We want all users to use their corp email via Okta, and in any other case simply be blocked from logging in.

Mikael Sandberg · Answer

Hi @Alex Billings,

Welcome to Atlassian Community!

Those two default policies are expected, one it for the local user directory (for users that are not synced from idP) and the other one is for your synced Okta users. Each user directory can have multiple policies and the default indicate one Atlassian should add the user to. You can learn move about authentication policies in this KB.