Proposal to prevent Accidental Site Creations #accidentalit

[#1]

As I've documented, "managed" users in claimed domains continue to accidentally create Jira and Confluence sites because the public landing pages for those products kind of "trick" them into going down the wrong path.

I was thinking that other SaaS products must have similar issues. Here's why they don't.

If you go to http://asana.com, here is an non-user sees vs a user who is currently/has previously logged in:

Similarly, https://www.airtable.com also somehow "knows" who you are and doesn't try to trick you into signing up for a new service.

Alas, when a logged-in user ends up on https://www.atlassian.com/, instead of showing them a list of existing sites the user has access to, it prompts the user to sign up for a new site.

You can see it "knows" me, because there's my name and profile photo in the top-right corner. (Which actually adds to the confusion later when it Welcomes you to your new site by name, and auto-suggests a new site name that includes your Org name.)

What's FRUSTRATING is that it SEEMS like Atlassian is working on this. If your cookies/sessions are "just so", you will sometimes get this page when going to  https://www.atlassian.com/software/jira

But for https://www.atlassian.com/software/confluence users will see this:

Probably the saddest thing is that there are teams at Atlassian who have spent time putting together a "portal" site at https://team.atlassian.com/ (or is it https://home.atlassian.com/ ?) that would be a perfect place to redirect already logged in users to:

But nothing automatically takes you there. "Atlassian Home/Start" is hidden/buried in the little Grid button next to your avatar/profile pic.

I'm sure some of you use other SaaS tools that deal with this better than Atlassian. I welcome your screenshots and examples. Thanks!

[Dave Liao]

Thanks for putting this together! I now want to test what happens in various SaaS tools in this particular scenario…

[Joe Johnson]

Props to @Darryl Lee for basically doing Atlassian's work for them! Sending in logged-in users direct to Atlassian Home/Start is clearly the right choice for this.

[Emily Moulder]

This could save a lot of headaches for sure.

[Jason M_]

I commend you @Darryl Lee in spreading awareness and helping me understand why the sudden increase in new sites that were created were entirely by accident, as users are practically ushered into creating a new site when presented with this flow.

I wanted to test the cookie configuration hypothesis on the above, so navigated to https://www.atlassian.com/software/jira (new Firefox session) and input my managed account email & was initially directed to:

I closed that window...but when coming back to the URL it presented the "fixed" version:

This only occurred because I did not create a new site. Beginner users not familiar with the structure are still ushered immediately to a new site option.

Still, this seems to be a step in the right direction.....

[Darryl Lee]

Keep Hope Alive

Hey so... it seems that Atlassian is trying to address this issue. Check this out:

The problem? roku-team isn't our actual Jira site URL. Let me explain.

I recently created a roku-team.atlassian.net "rogue site" on purpose.

Why?

Well, if you've been following along, you'll know that Atlassian auto-suggests new sites to be created for users already authenticated according to the following naming convention:

YOURDOMAIN-team-RANDOM.atlassian.net

So as previously mentioned, I've had over 40 sites accidentally created, and they were named things like:

• roku-team-t2sepz2w.atlassian.net
• roku-team-e2gksmfd.atlassian.net
• roku-team-bweeuwii.atlassian.net
• roku-team-pvjr3mu3.atlassian.net
• roku-team-we77ppos.atlassian.net

Interestingly, we've also had roku-team.atlassian.net created by accident THREE SEPARATE TIMES. That's right, after going through the rigamarole of adding contacting the creator, adding myself as an admin (both of those only possible with an Atlassian Guard subscription), and requesting and waiting for DELETION, the site came back.

The reason? Because if it's available, Atlassian will auto-suggest roku-team.atlassian.net as the a new site to create.

So. I'm hoping that users might pause if they see a weird random set of characters after "roku-team", but yeah no, it probably won't help.

But still, "squatting" on roku-team.atlassian.net will keep people from accidentally recreating THAT site again. (Thanks for the suggestion @Matthias Gaiser _K15t_ - I know you were kidding, but it actually makes sense!)

SO HERE'S THE PROBLEM (maybe) with why our REAL site doesn't get suggested by the new pop-up:

Way back in 2021 (!!!!), Atlassian created a "new" User Management Experience. Internally this is known as "Vortex". 

In February 2024 they announced they would be rolling this to customers on the "old" experience, but only for organizations with a single-site. (We have a separate JSM, and also, Sandboxes, which yes, count as multiple-sites even though they are "tethered" to your Premium and Enterprise instances.)

To users, this is mainly just UI stuff. Configs moved around to different screens. A few roles got eliminated/etc etc. Whatever.

BUT APPARENTLY behind the scenes, it's a much bigger deal. For one thing, certain API endpoints like "Search for users in an organization" or these various endpoints only work if you're on Vortex. Also certain Early Access Programs (like for Cross-site Confluence KB Linking) require you to be on the new user management experience.

Unfortunately, I believe our org was created before 2021, AND we have multiple sites in our org, AND we have the same sets of users in those multiple sites (including Sandboxes), which means it's apparently very hard for Atlassian to migrate us to Vortex.

FINALLY, I believe this is why in the new screen up above, I am being prompted to log into the WRONG site (roku-team.atlassian.net) instead of roku.atlassian.net

Anyways, yes I'll be filing a ticket about this, but I thought others might want to know that at least Atlassian does seem to be trying to do something about this problem. Finally.

(Oh, by the way, I didn't get the nice pop-up on my phone. *Sigh*.)

[Matthias Gaiser _K15t_]

All the best, @Darryl Lee, for hopefully getting it fixed soon. I'm always in for creative ideas to workaround something Atlassian does not (yet) do.

[Chris Rogers]

Props for calling this issue out. We've had numerous clients reach out concerned about this, and the disappointing part is that you can prevent this on an organization admin level but only for enterprise-level customers. The functionality is there and shouldn't be gated to the highest tier of customers; I think Atlassian can and should do better on this.