Bitbucket Cloud account ownership and data access

[#1]

Hi All,

By popular demand we wanted to provide insights into how Bitbucket Cloud account ownership is established. In order to be able to access your Bitbucket account and its content, we use your email address to verify account ownership, so its very important to make sure that your email is up to date and valid. We would like to provide more details on what the Support Team can help you with and what is outside of our scope.

Let's start with, who do we consider the account owner based on account type and how do we verify it on our side.

But before we jump in, lets clarify the type of accounts that currently exist on Bitbucket:

• personal non-managed account - managed by an individual;

• shared workspace - owned and managed by the group of Administrators;

• personal managed account - managed by the Organization and Organization Admin(s).

Personal non-managed accounts:

The account ownership is verified based on the Primary email address associated with the Bitbucket Cloud account, this also includes Primary billing user email address in case its different from the primary email on account.

Workspaces:

Workspaces are managed by a group of Administrators (any user in that group is considered the owner). This also includes Primary Billing/Technical contacts, even when they are not part of the Administrators group.

Personal managed accounts:

When the primary email address on account is managed by the organization that has claimed  and confirmed company domain with Atlassian. These accounts are considered ownership of the Organization and are managed by the Organization Admins. 

What the Bitbucket support team CAN help you with:

For managed accounts where the domain is claimed by an Organization:

• We can let you know who the Organization Admin is, only Admins can help with updating primary email address for users on managed domain. For more details around managed accounts, please refer to Managed accounts.

• Managed accounts are owned by the organization, any content that you create on the managed account is considered the ownership of the organization who claimed the domain with Atlassian.

For non-managed accounts:

• We can help guide you on how to update your primary email address on your Bitbucket account, when you are able to login and just need guidance on how to promote the alias email to be Primary or need to change it all together.

• We can help update your alias email address to be your primary for login purposes.

• We can help with sharing the names (but not the email addresses) of users who are Admins/Billing contacts for a given account.

• In case of lost access to an account, we can share with you the name of the user who revoked your access.

What the Support Team CANNOT help you with:

• We cannot change the primary email address on account if the requested email is not associated with it in any way.

• We cannot change the account owner to someone who is not listed in our system (see above).

• We cannot share the email address listed on a Bitbucket account as Primary. Even when the user claims to be the owner, we have no ability to verify ownership of the email or account, except based on the Support requester email address or what we already have listed in our internal tools.

• We cannot transfer any repositories from one account to another on user’s behalf. (The repository Admin can self-service it by following the steps outlined here: Repository ownership transfer)

• We cannot delete accounts that own data on behalf of a user, but happy to provide guidance on how to accomplish that task.

Account and content recovery options:

What options does the user have when trying to recover account access or its content?

• You need to know the primary email address associated with that account to be able to login.

• You need to have access to that email to be able to recover the password if forgotten.

• For non managed accounts, as long as you know the account credentials, even if you have lost access to the email address, you should be able to clone core repositories content (the clone will exclude metadata like Issues, comments and Pull Requests).

• If you have access to the SSH key associated with that account - you should be able to clone core GIT repositories to get backup and upload them to a new account .

Avoid losing access:

What should you keep in mind to avoid losing access to your Bitbucket account and data stored on there.

• Make sure that your Bitbucket Cloud account email address is always up to date.

• Before changing mobile devices, make sure you disable 2FA on your Bitbucket account and set it up again with the new device. For more details please refer to Replace a device and temporarily disable 2FA.

• Keep a backup of 2FA recovery codes in a safe place.

• Before changing laptops, make sure you get a back up of any SSH keys associated with Bitbucket and backup repositories.

Please remember, that our Support team is happy to help as much as we can, when reaching out to support for account related issue, please keep the above details in mind.

[Andy - PTC Redundant]

Great write up!
Also handy for Admins and Primary Billing Contacts to know that the bitbucket SEN can be seperate to the main Jira and/Or Confluence SEN

In addition, the Bitbucket account is not going to show up under the manage subscriptions page... which can be confusing!

[Caroline R]

Great article, @Yana! Thanks for sharing this!