Grant access to your organization
10 min
By the end of this lesson, you'll be able to:
- Assign app roles
- Define approved domains
- Configure user invites
- Configure invitation links
Grant access through roles and domains
Grant access through app roles
You can grant users access to apps using app roles. User and app admin roles are the two primary app roles used for all apps. Jira Service Management has two app-specific roles, Customer and Stakeholder, and Confluence has the Guest role.
👇Click the tabs below to explore how admins can assign roles.
Admins can assign app roles or the user access admin role by selecting Grant access in the user page.
Org admins can assign the org admin or site admin roles using More actions (represented by ···) at the top right of the user page.
With the exception of the site admin role, all roles are assigned via group membership. Each role is associated to a default group that automatically grants access to that role.
Admins assign the app admin role for Jira app in a slightly different way. There are three apps in the Jira family: Jira, Jira Service Management and Jira Product Discovery. Instead of assigning the app admin role to each of the Jira apps, you only assign it once to the Jira Administration app.
Grant access through approved domains
Approved domains allow you to grant automatic app access to user accounts with emails under a specified approved domain. This can be set up per app per site.
You could approve your company domain so onboarding is easier for your employees, or you could approve customer domains so they can always get access without having to actively request it.
The org admin and the user access admin can configure approved domain settings so that users from a specified domain can access the configured apps with or without an approval.
To add an approved domain:
- Go to admin.atlassian.com and select your organization.
- Expand Apps from the sidebar, then the App access settings section.
- On the Approved domains tab, select Add domain.
- Enter the approved domain name (like acme.com.)
- Set the roles for the apps you’d like users under this domain to access.
- Select the Admin approval checkbox to stay on top of the license count.
- Click Save.
All user accounts with emails under acme.com are able to request access to Confluence on acmeus site. When they do, app access requests are generated and org admins, or site admins for acmeus are able to approve or deny them.
Grant access through invitations
Grant access through user invites
Org admins can configure user invites to control how existing users can invite and request access for other individuals. User invites allow any user in your organization to invite additional users with, or without admin approval. When a user accepts the invitation, they can access the apps you invited them to. User invite settings are set for each app in your organization.
User invites configuration is different from the Invite users feature that org admins can use to invite new users from the admin hub Users page.
👇Click the boxes below to explore the different settings you can select for each Atlassian app in your organization.
When Invite anyone or Require admin approval option is selected, existing users can invite users with any email address, including non existing emails.
Grant access through invitation links
Invitation links are sharable URLs that are used to easily give access to your apps. Invitation links don’t require admin approval, therefore, org admins must be careful when sharing the links with others. You can use invitation links to appoint another individual that you trust to grant access to a specific app.
Invited users are added to the default access group for that app. Org admins can generate invitation links for any app. User access admins can generate invitation links for the app they administer.
Invitation links automatically expire after 30 days, but an org admin can also turn them off before the 30 days are up. They can also choose to generate a new URL.
Invited users will get app access without admin approval, so take care when creating and sharing invite links.
Grant access using the Invite users feature
Org admins and user admins can invite users to apps within their organization from the Users page in the admin hub. When an admin invites a user, they will receive an email inviting them to the relevant app.
To invite a user as an org/user admin:
- Go to admin.atlassian.com and select your organization.
- From the admin hub, select the Directory tab.
- From the right sidebar, select the Users tab.
- From the top right of the page, select Invite users.
- In the window that appears, enter the email of the user you would like to invite.
- Specify the user’s access level for each app in your organization through the app roles drop-down menu.
- Specify any additional group memberships you need to grant to the user.
- Optionally, you can customize the invitation email that the user will receive.
- Finally, select Invite users.
The user will receive an invitation to the selected apps. If the user has an Atlassian account, they will be able to login to the apps straight away. If not, they will be invited to sign up for an Atlassian account.
Manage access requests
When users without access land in a specific app, they will have the option to request access. This will generate an access request that org admins or site admins can approve or deny.
Access requests are only for user app access, they are never about admin privileges or in app permissions such as creating work items.
Who can request access?
Existing users can request access to new apps for themselves. Additionally, they can request access for other existing users or completely new users, but only to apps they have access to. New users with a verified email address and an Atlassian account can also request access.
Whether a user can request access depends on the user access settings:
- Approved domains: By default, users with a private domain can request access to your apps.
- User invites: When Require admin approval option is selected, access requests are generated when an existing user invites another user to an app.