Grant access to your organization
10 min
Advanced
By the end of this lesson, you'll be able to:
- Assign product roles
- Define approved domains
- Configure user invites
- Configure invitation links
Grant access through roles and domains
Grant access through product roles
You can grant users access to products using product roles. User and product admin roles are the two primary product roles used for all products. Jira Service Management has two product-specific roles, Customer and Stakeholder, and Confluence has the Guest role.
👇Click the tabs below to explore how admins can assign roles.
Admins can assign product roles or the user access admin role by selecting Grant access in the user page.
Org admins can assign the org admin or site admin roles using More actions (represented by ···) at the top right of the user page.
With the exception of the site admin role, all roles are assigned via group membership. Each role is associated to a default group that automatically grants access to that role.
Admins assign the product admin role for Jira product in a slightly different way. There are two products in the Jira family: Jira and Jira Service Management. Instead of assigning the product admin role to each of the Jira products, you only assign it once to the Jira Administration product.
Grant access through approved domains
Approved domains allow you to grant automatic product access to user accounts with emails under a specified approved domain. This can be set up per product per site.
You could approve your company domain so onboarding is easier for your employees, or you could approve customer domains so they can always get access without having to actively request it.
The org admin and the user access admin can configure approved domain settings so that users from a specified domain can access the configured products with or without an approval.
To add an approved domain:
- Go to admin.atlassian.com and select your organization.
- Select the Products tab, then the User access settings section.
- On the Approved domains tab, select Add domain.
- Enter the approved domain name (like acme.com.)
- Set the roles for the products you’d like users under this domain to access.
- Select the Admin approval checkbox to stay on top of the license count.
- Click Save.
All user accounts with emails under acme.com are able to request access to Confluence on acmeus site. When they do, product access requests are generated and org admins, or site admins for acmeus are able to approve or deny them.
Grant access through invitations
Grant access through user invites
Org admins can configure user invites to control how existing users can invite and request access for other individuals. User invites allow any user in your organization to invite additional users with, or without admin approval. When a user accepts the invitation, they can access the products you invited them to. User invite settings are set for each product in your organization.
User invites configuration is different from the Invite users feature that org admins can use to invite new users from the admin hub Users panel.
👇Click the boxes below to explore the different settings you can select for each product in your organization.
When Invite anyone or Require admin approval option is selected, existing users can invite users with any email address, including non existing emails.
Grant access through invitation links
Invitation links are sharable URLs that are used to easily give access to your products. Invitation links don’t require admin approval, therefore, org admins must be careful when sharing the links with others. You can use invitation links to appoint another individual that you trust to grant access to a specific product.
Invited users are added to the default access group for that product. Org admins can generate invitation links for any product. User access admins can generate invitation links for the product they administer.
Invitation links automatically expire after 30 days, but an org admin can also turn them off before the 30 days are up. They can also choose to generate a new URL.
Invited users will get product access without admin approval, so take care when creating and sharing invite links.
Grant access using the Invite users feature
Org admins and user admins can invite users to products within their organization from the Users page in the admin hub. When an admin invites a user, they will receive an email inviting them to the relevant product.
To invite a user as an org/user admin:
- Go to admin.atlassian.com and select your organization.
- From the admin hub, select the Directory tab.
- From the right sidebar, select the Users tab.
- From the top right of the page, select Invite users.
- In the window that appears, enter the email of the user you would like to invite.
- Specify the user’s access level for each product in your organization through the product roles drop-down menu.
- Specify any additional group memberships you need to grant to the user.
- Optionally, you can customize the invitation email that the user will receive.
- Finally, select Invite users.
The user will receive an invitation to the selected products. If the user has an Atlassian account, they will be able to login to the products straight away. If not, they will be invited to sign up for an Atlassian account.
Manage access requests
When users without access land in a specific product, they will have the option to request access. This will generate an access request that org admins or site admins can approve or deny.
Access requests are only for user product access, they are never about admin privileges or in product permissions such as creating work items.
Who can request access?
Existing users can request access to new products for themselves. Additionally, they can request access for other existing users or completely new users, but only to products they have access to. New users with a verified email address and an Atlassian account can also request access.
Whether a user can request access depends on the user access settings:
- Approved domains: By default, users with a private domain can request access to your products.
- User invites: When Require admin approval option is selected, access requests are generated when an existing user invites another user to a product.