Proposal to prevent Accidental Site Creations #accidentalit

[#1]

As I've documented, "managed" users in claimed domains continue to accidentally create Jira and Confluence sites because the public landing pages for those products kind of "trick" them into going down the wrong path.

I was thinking that other SaaS products must have similar issues. Here's why they don't.

If you go to http://asana.com, here is an non-user sees vs a user who is currently/has previously logged in:

Similarly, https://www.airtable.com also somehow "knows" who you are and doesn't try to trick you into signing up for a new service.

Alas, when a logged-in user ends up on https://www.atlassian.com/, instead of showing them a list of existing sites the user has access to, it prompts the user to sign up for a new site.

You can see it "knows" me, because there's my name and profile photo in the top-right corner. (Which actually adds to the confusion later when it Welcomes you to your new site by name, and auto-suggests a new site name that includes your Org name.)

What's FRUSTRATING is that it SEEMS like Atlassian is working on this. If your cookies/sessions are "just so", you will sometimes get this page when going to  https://www.atlassian.com/software/jira

But for https://www.atlassian.com/software/confluence users will see this:

Probably the saddest thing is that there are teams at Atlassian who have spent time putting together a "portal" site at https://team.atlassian.com/ (or is it https://home.atlassian.com/ ?) that would be a perfect place to redirect already logged in users to:

But nothing automatically takes you there. "Atlassian Home/Start" is hidden/buried in the little Grid button next to your avatar/profile pic.

I'm sure some of you use other SaaS tools that deal with this better than Atlassian. I welcome your screenshots and examples. Thanks!

[Dave Liao]

Thanks for putting this together! I now want to test what happens in various SaaS tools in this particular scenario…

[Joe Johnson]

Props to @Darryl Lee for basically doing Atlassian's work for them! Sending in logged-in users direct to Atlassian Home/Start is clearly the right choice for this.

[Emily Moulder]

This could save a lot of headaches for sure.

[Jason M_]

I commend you @Darryl Lee in spreading awareness and helping me understand why the sudden increase in new sites that were created were entirely by accident, as users are practically ushered into creating a new site when presented with this flow.

I wanted to test the cookie configuration hypothesis on the above, so navigated to https://www.atlassian.com/software/jira (new Firefox session) and input my managed account email & was initially directed to:

I closed that window...but when coming back to the URL it presented the "fixed" version:

This only occurred because I did not create a new site. Beginner users not familiar with the structure are still ushered immediately to a new site option.

Still, this seems to be a step in the right direction.....

[Darryl Lee]

Keep Hope Alive

Hey so... it seems that Atlassian is trying to address this issue. Check this out:

The problem? roku-team isn't our actual Jira site URL. Let me explain.

I recently created a roku-team.atlassian.net "rogue site" on purpose.

Why?

Well, if you've been following along, you'll know that Atlassian auto-suggests new sites to be created for users already authenticated according to the following naming convention:

YOURDOMAIN-team-RANDOM.atlassian.net

So as previously mentioned, I've had over 40 sites accidentally created, and they were named things like:

• roku-team-t2sepz2w.atlassian.net
• roku-team-e2gksmfd.atlassian.net
• roku-team-bweeuwii.atlassian.net
• roku-team-pvjr3mu3.atlassian.net
• roku-team-we77ppos.atlassian.net

Interestingly, we've also had roku-team.atlassian.net created by accident THREE SEPARATE TIMES. That's right, after going through the rigamarole of adding contacting the creator, adding myself as an admin (both of those only possible with an Atlassian Guard subscription), and requesting and waiting for DELETION, the site came back.

The reason? Because if it's available, Atlassian will auto-suggest roku-team.atlassian.net as the a new site to create.

So. I'm hoping that users might pause if they see a weird random set of characters after "roku-team", but yeah no, it probably won't help.

But still, "squatting" on roku-team.atlassian.net will keep people from accidentally recreating THAT site again. (Thanks for the suggestion @Matthias Gaiser _K15t_ - I know you were kidding, but it actually makes sense!)

SO HERE'S THE PROBLEM (maybe) with why our REAL site doesn't get suggested by the new pop-up:

Way back in 2021 (!!!!), Atlassian created a "new" User Management Experience. Internally this is known as "Vortex". 

In February 2024 they announced they would be rolling this to customers on the "old" experience, but only for organizations with a single-site. (We have a separate JSM, and also, Sandboxes, which yes, count as multiple-sites even though they are "tethered" to your Premium and Enterprise instances.)

To users, this is mainly just UI stuff. Configs moved around to different screens. A few roles got eliminated/etc etc. Whatever.

BUT APPARENTLY behind the scenes, it's a much bigger deal. For one thing, certain API endpoints like "Search for users in an organization" or these various endpoints only work if you're on Vortex. Also certain Early Access Programs (like for Cross-site Confluence KB Linking) require you to be on the new user management experience.

Unfortunately, I believe our org was created before 2021, AND we have multiple sites in our org, AND we have the same sets of users in those multiple sites (including Sandboxes), which means it's apparently very hard for Atlassian to migrate us to Vortex.

FINALLY, I believe this is why in the new screen up above, I am being prompted to log into the WRONG site (roku-team.atlassian.net) instead of roku.atlassian.net

Anyways, yes I'll be filing a ticket about this, but I thought others might want to know that at least Atlassian does seem to be trying to do something about this problem. Finally.

(Oh, by the way, I didn't get the nice pop-up on my phone. *Sigh*.)

[Matthias Gaiser _K15t_]

All the best, @Darryl Lee, for hopefully getting it fixed soon. I'm always in for creative ideas to workaround something Atlassian does not (yet) do.

[Chris Rogers]

Props for calling this issue out. We've had numerous clients reach out concerned about this, and the disappointing part is that you can prevent this on an organization admin level but only for enterprise-level customers. The functionality is there and shouldn't be gated to the highest tier of customers; I think Atlassian can and should do better on this.

[Darryl Lee]

YOU GUYS. I have an idea.

So, I have a strong suspicion that somebody at Atlassian doesn't think this is a problem, because "Hey, users can get to their existing sites from the home page already via the Application Navigator button next to their avatar":

In the immortal words of Wayne Campbell, "Sh'yeah, right!".

I feel like that button (which I'm going to call the tic-tac-toe button) is derivative of Hamburger Menus, and those suck for many reasons. But for our purposes, the reason to hate it is simple.

It is unlabeled, so people don't know what it does. But they DO see a giant Blue "Get started" button, and so they click on that.

But yeah so, uh, I have a wild idea. Much like the sites I've already cited, Airtable, and Asana, Atlassian could add a "Log in" or "Sign in" button. Nevermind that my Avatar already indicates that I'm logged in. Users don't think to click on that or the unlabeled button next to it to log in. It is not obvious. I'm not a UX/UI designer, but I think there's a rule that things should be obvious.

ANYWAYS. My wild idea? It's potentially VERY EASY.

A few years ago Atlassian registered the domain make.page as a shortcut to create Confluence pages, and it turns out they also registered confluence.new and jira.new. It's a neat feature, but here's what's really interesting to me: The magic URL they redirect you to KNOWS WHAT Jira/Confluence you are already logged into. (Caveat: this is complicated if you use multiple Jira/Confluence sites, but I'm 99% sure accidental sites are being created by users of just one site.)

Those magic URLs are:

• https://id.atlassian.com/gateway/api/product-redirect?product=jira
• https://id.atlassian.com/gateway/api/product-redirect?product=confluence

Try them! You'll see that those links are able to "figure out" what site you are logged into, and it will redirect you to the issue or page create workflow.

SO!

If a new product could be created like "jira-home" or "jira-default", it conceivably redirect you just to the home page for your sites.

Link this to a simple "Sign in" or "Log in" button on those product pages, and I think that would prevent most of the accidental site creations.

Yeah, your designers will cry that another Button is redundant! It messes up their beautiful design. 

I hate to say it, but nobody cares. What we do care about is all of these freaking sites that we have to keep cleaning up. (I've had to deal with 4 created in the last two weeks.)

Please help fix #accidentalit. Thanks for attending my Ted Talk.

[marc -Collabello--Phase Locked-]

Atlassian should do this asap.

[Chris Rogers]

Another three sites this week across various client sites.

[Jason M_]

Another 2 sites created unintentionally by users here.

[Myra Chachkin]

Thank you for writing this, and 

https://community.atlassian.com/t5/Questions/Why-is-Atlassian-promoting-Shadow-IT-Or-Accidental-IT/qaq-p/2731538

[Darryl Lee]

Happy new year everyone! Welp, it seems like the Jira team, at least, is trying to address this issue. When I go to the Jira product page at https://www.atlassian.com/software/jira, I'm very pleased to see that I am prompted with the option to "Pick up where you left off in Jira" and go to my Organization's Jira instance:

Progress! Hey Jira product page owners, can you please share your code with the Confluence product page owners? Oh, and while you're at it maybe get that Team '23 banner to stop popping up? (Yes, I've previously dismissed it.)

[Dave Liao]

Wait, you’re not a time traveler?

[Darryl Lee]

Well, this is progress:

@Charles Blaxland has gotten @Derrick Nguyen to file this Suggestion:

• CLOUD-12193 - Reduce occurrences of accidental site creations 

I think all the major points are covered, so I look forward to everyone voting it up.

I don't look forward to Atlassian letting it languish for several years. :-/

Thanks a lot Charles and Derrick!

[Darryl Lee]

WOOT!

@Charles Blaxland followed up in CLOUD-12193 to let us know this is fixed (we hope)!

Because his screenshots didn't turn out in that ticket, I made some and posted them here:

• Why is Atlassian promoting Shadow IT? Or Accidental IT?