Can you explain more about who owns a free Jira or Confluence account created with a work email ID?

Question

1. Is the ownership attributed to the company or classified as personal use?
2. What are the legal implications?
3. How does IT governance apply here?
4. Can the company revoke access?

Arkadiusz Wroblewski · Accepted Answer

Hi @Vamsi Krishna BS ,

Here’s a small breakdown of how ownership works:

1. Accounts: Accounts registered with work emails fall under company control once you verify and claim your domain.

2. Sites: Employee-created sites are treated as "shadow IT," but org admins can discover and consolidate them.

3. Data: Under Atlassian terms, the company legally owns all data created using a work email.

4. Access: Admins can revoke site permissions or deactivate managed accounts at any time.

Best,

Arek 🤠

Viswanathan Ramachandran · Accepted Answer

Hi @Vamsi Krishna BS

See below

* Ownership:* It depends on the email domain. If the account uses a corporate email and you have verified that domain in your Atlassian Organization, the company owns it (Managed Account). If it's a personal email the individual owns the account itself.

* Legal Implications: * Work product and data created in your instance generally belong to the company (standard IP clauses). However, trying to seize control of a user's unmanaged personal account could violate privacy regulations like GDPR.

* IT Governance:* Governance hinges on domain verification and Atlassian Guard. Once your domain is claimed, IT can enforce SSO, 2FA, and full lifecycle management over those managed accounts.

* Revoking Access:* Yes, it can be revoke a user's access and licenses to your specific Jira/Confluence sites, regardless of their email type.

Best Practice: Verify your domains early and use Atlassian Guard. Avoid inviting personal emails to your company instance (except personal use). FYI strict governance is a must/priority.

A few follow-up Q&As

* Is setting up a free site/organisation against company policy?* Yes, in almost all corporate environments, doing this is a direct violation of IT Security and Data Governance policies.

* Can the company block users from creating these free sites?* Yes, but again it depends on your Atlassian plan. For enterprise plan, you can use Atlassian’s Product Request settings to completely block managed users from creating new cloud sites or organisations. Any attempt by a user to spin up a new site will require an Admin’s review and approval.
* Your company security policy also matters here, it can block you entirely accessing external sites or put restriction.
* If you like to test Cloud for your company, it will be agreement between your company and Atlassian and you will use test/sandbox.

* For personal use and knowledge, use your personal details in your personal computer.

Karl from Ricksoft · Accepted Answer

@Vamsi Krishna BS ,

Taking these one at a time:

* Is ownership attributed to the company or classified as personal use?* By default, personal,  even if you sign up with a work email, you own the individual Atlassian account, not the company. This is true unless/until the domain is verified (see below).

* Legal implications?* I won't speak to your specific legal exposure, but structurally: until the company verifies the domain, the account is treated as an "external user" to the company's Atlassian organization, similar in principle to a contractor's account. the company can grant/revoke access to its own sites, but doesn't own the underlying account or its data.

* How does IT governance apply?* A company admin can verify ownership of the email domain (e.g. @yourcompany.com) at admin.atlassian.com. Once verified, any account using that domain becomes eligible to be "claimed" as a managed account, this is the mechanism IT governance actually runs through, not something automatic just from using a work email to sign up.

* Can the company revoke access?* Before claiming: only from the company's own sites (removing the user from a specific Jira/Confluence instance), not the account itself. After claiming (managed account): yes, the org admin can edit, deactivate, or delete the account directly.

Some docs to explore:

https://support.atlassian.com/user-management/docs/what-are-managed-accounts/

https://support.atlassian.com/user-management/docs/verify-a-domain-to-manage-accounts/