nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Preventing Users to invite others, is it possible?

Yanis_2v96r7

Hi,

I want to Prevent/Disable the option from newly invited users to invite others during the first Setup process of the newly invited user. How can I achieve that.

I already unchecked this option from User settings, but yet, this option still exists via the first invitation link and wizard.

Accepted answers

All comments

Shannon S

Hi Yanis,

Any users that you have added to the site-admins group should have the ability to invite other users. If you do not want specific users to have this ability, then you will want to remove them as a site-admin.

Can you let me know if that's not the case and what issue you're having exactly with the invite user prompt?

Regards,

Shannon

David Sloane

I have a similar problem, with users who are definitely not site admins, inviting other users to join Confluence.

This generates emails to admins like this:

Subject: Someone wants to invite another user to Confluence
Body:
The user [person1]@[domain] needs access to Confluence
[person 2] wants to invite [person1]@[domain], so they can both work on x.atlassian.net. You can approve access requests from your Site administration.

{etc.}

Can this feature be disabled?

I've seen this question asked in several forums, but no clear answer for Confluence Cloud

Shannon S

There's a new feature now that allows you to add trusted users to invite other users:

Invite, Edit, and Add Users

Screen Shot 2019-02-25 at 12.16.48 PM.png

Can you have a look and let me know what sort of permissions Person 2 has there?

Do you know what they did to trigger the invite email specifically?

Regards,

Shannon

David Sloane

Thanks for the feedback!

That Invite/Edit/Add page refers to permissions, which I don't see anywhere in the user management interface.

Person 2 is an external, non-staff user, with limited permissions. I don't know what they're doing, to generate this invitation.

Shannon S

David,

The permissions are available in Site Administration > User management > Users. When you click Show details next to the user, you'll see under Roles on the left which role they have.

Screen Shot 2019-03-01 at 2.27.26 PM.png

Can you have a look and confirm that you see that?

Take a look at what role you have set for that user, and confirm with me what permissions you have set for them. I assume by "external" user you don't mean external to Confluence, but a licensed internal Confluence user which is external to your organization. Can you confirm?

Regards,

Shannon

Rachmad Kusairi

I don't know it will be related or not, but I want to know, how to disable the "Invite Team" menu from the project?

Screenshot from 2021-01-20 11-43-27.png

it turns out, the non-administrator could invite other people and get the license.

jennifer.sewell

I am experiencing this same issue. Non admins can sent invite emails to anyone with this option, even though the site admin allow users to invite is turned off. This is very bad!

Adam Sterrie_rxu0sl

This sounds like a huge information security loophole and a nightmare for Jira Admins that work for organisations that are careful about information security.
Surely "Invite team" should mean just that and not "Invite anyone in the world to team and give them a license as well"!
Is anyone in Atlassian responsible for closing security loopholes to whom we could forward this issue?

Mark J Cunningham

There are different "Invite users"

Site-admin get the Invite users button, which you can add people to groups as well

Conf users (basic no added privileges) can invite users via Share page

Jira users (basic no added privileges) can invite users via Share

There should be a setting to stop shares to outside of those who already have an Atlassian account, else you end up being spammed with invite requests, which is even more annoying as then they are added sans groups, so you have to go back into each one and add them to the relevant groups.

Mark J Cunningham

It is not the pure "invite user" as per site-admin

Its the way Basic users even when Invite user is switched off can generate a different invite.

It basically means that switching off invite users does absolutely nothing to stop rouge invites.

This is not a "feature", or any kind of expected behavior - it is a risk and potential security breach

this bug we reported, which turned out to be an expected behavior:

Douglas Maia_fvz478

Through an option on the settings site it is possible to restrict users from inviting others:

Mark J Cunningham

Even when that is not checked, I still see loads of invites that can be generated by all roles of users

Mark J Cunningham

email comes in like

Summary: <basic user with no admin rights> invited <invited user> to your Atlassian site

<basic user with no admin rights> invited <invited user> to your Atlassian site
Hi Mark J Cunningham,
<basic user with no admin rights> (<basic user with no admin rights email address>) has invited <invited user> to work with your team. Here's some more information about them:
<invited user>
<email address>
New user at <site>
View profile
View your invite settings

According to setting this should not be possible:

Sasi Vijayakumar_0ie63t

There are 4 options from Admin-> products -> user access settings.

Invite anyone, Invite approved domains, Require admin approval, Don’t allow invites

support documentation

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

confluence

cloud

confluence-cloud