Cloud Enterprise admins can now proactively manage product requests

[#1]

Update: February 21, 2024

Hi everyone - we are happy to share that a new enhancement to Automatic Product Discovery, an Atlassian Access feature, is now generally available. This enhancement allows org admins to take over control of previously unmanaged products, addressing the risks associated with shadow IT.

To learn more about the release, please visit our latest Access community post.

Update: October 5, 2023

Thank you for your active participation and feedback following our announcement of product requests. We want to address some of the feedback we've heard and share our strategy for addressing shadow IT risks now and going forward.

The Cloud Enterprise (CE) plan solves the challenges of customers operating our products at a large scale by addressing their complexity, governance, advanced security, and compliance needs. The Atlassian Access product solves for more foundational security requirements and provides identity and access management support. We have implemented solutions for shadow IT risks based on customer differentiation in both CE and Atlassian Access.

The product requests feature will help our CE customers in large, complex environments more closely monitor shadow IT risks as they scale, bolstering our advanced security pillar of CE. For customers with Atlassian Access, we will be adding enhancements to Automatic Product Discovery (APD). The first enhancement is scheduled for release this month and will introduce a new "last active date" field to APD.

With this enhancement, admins will be able visit the 'Discovered Products’ tab within Atlassian Administration and easily identify long inactive shadow IT instances and prioritize recently active ones to take action on. The next APD enhancement will provide org admins with one-click access to ‘join’, or add themselves to, shadow IT instances and take over the management of said instance. 

Thank you again, and look out for more updates in the Enterprise Community from our team.

---

Uncontrolled shadow IT, defined as the use of IT-related hardware or software by an individual without the knowledge of the organization's admin or IT department, continues to be a challenge for enterprise customers. It can lead to decreased control of potentially sensitive data and an increased risk of data loss.

Ensuring that enterprise admins have visibility into what shadow IT may exist within their organization is paramount to addressing these risks, as cloud organizations cite lack of visibility (38%) and the inability to enforce security (33%) as two of the top five operational day-to-day headaches they face.

We have received feedback from our enterprise customers and admin community regarding the necessity for more admin controls to tackle this form of shadow IT, and we are excited to announce product requests.

Before product requests, admins had visibility into instances created by managed users in their org through automatic product discovery. With this new feature, action can be taken.

Note: The product requests feature will begin rolling out today, September 12, 2023, and will be available to all Cloud Enterprise customers on September 15, 2023.

How it works:

For Jira Software, Confluence, and Jira Service Management’s Cloud Enterprise plans, product requests allows organization admins to prevent their managed users from signing up for products on their own.

Now, when a user tries to sign up for a product, Atlassian will send that user to a page where they enter details about how they plan to use the product. Admins will review all their users' requests, from the product requests page, and either resolve or deny any instances from being created.

Accessing the feature

Under admin.atlassian.com’s ‘Security tab’, an enterprise admin can now access product requests on the left-hand side of their view.

Admins will now be able to set a policy to either:

• Allow new products: users can create new products outside their current managed organization

• Require admin review: users will submit requests for new products for admins to review and resolve

Reviewing requests:

If an admin selects ‘Require admin review,’ they will begin to see requests come in from their users.

They can review each individual request and determine if it is denied, or under review.

If it is marked under review, we recommend contacting the requestor and determining if the instance is permissible by your organization and should then be created on their behalf.

If the admin marks the request as denied, we will notify the requestor of the denial.

With this new feature, admins gain additional visibility and control to help their organizations quickly take action to proactively monitor user activity and tighten their cloud footprint.

What’s next?

In the current version of product requests, we prioritized denial capabilities as it was our admin focus groups' most requested capability. However, we plan to expand its capabilities in the future for a smoother ‘review’ and ‘approval’ process.

We’d love to hear your thoughts, feedback, and questions about product requests. Leave a comment and let’s chat.

[Darryl Lee]

So Cloud Enterprise, which provides for "Unlimited" instances of Jira/Confluence/JSM is the only tier that prevents rogue instances from being spun up, whereas Atlassian doesn't provide this mechanism to users paying per instance on Premium?

Thanks a lot.

[Bryan Guffey]

Why is this gated to Enterprise? Please explain the technical limitations that make this the case, or why you chose to make this business decision. 

This doesn't seem to align with "No Bullshit" and "Don't F*ck the Customer," or are those values not important anymore? 

[jodi_klein]

Will this be offered to Premium instances?  Not sure why you would limit to just enterprise. 

[Mark Benson]

Echoing what's already been said - pay walling this behind Enterprise tier is a slap in the face to your  smaller customers. There is no good reason that this functionality shouldn't be available across the board... other than greed.

As Bryan has pointed out it seems with every major functionality upgrade/release in cloud Atlassian strays further and further away from it's original "core values". Not sure why you even bother to display these on your website anymore as most of them seem to not be applicable to the bigger projects you've delivered of late.

Seems like it's just become all about the money, and not about actually delivering better software overall.

[noble t trout]

Making a security feature a paywall feature is like... the first rule they tell you not to do when developing a product.

[Dave Liao]

@Vikki Ulmer - Happy this is a feature, but wish it was available to other pricing tiers, and not just Enterprise. 🫠

[Julien Béchade]

Hi @Vikki Ulmer

I'm really at a loss here...
I do not understand why this is not included in Atlassian Access instead since Access is included in the Enterprise plan. It would also make much more sense then since this is related to product access.
We would actually be ready to pay a tad more for Atlassian Access if that feature was part of it.

Could you at least explain the reasoning behind this decision?

Cheers.

Julien.

[CEDRIC DEVAUX]

Hello @Vikki Ulmer 

As you said in your introduction:

Uncontrolled shadow IT, defined as the use of IT-related hardware or software by an individual without the knowledge of the organization's admin or IT department, continues to be a challenge for enterprise customers. It can lead to decreased control of potentially sensitive data and an increased risk of data loss.

So explain us the reason why this feature is only available for Enterprise plan and not for the rest???

Security is a subject to everyone so security applies Standard, Premium and Enterprise Atlassian plan.

We're all concerned about the security of our companies' information, and letting our companies' users create uncontrolled jira, trello, confluence etc. instances is an information leak and therefore a security breach.

[Ilia.Dimitrov]

That is definitely going to help to keep governance of the products under Enterprise Plan.
Would be also very good to have a mechanism to control Bitbucket as we do not have any central management or a way to prohibit registration from managed accounts, for which we have claimed the domain.
Is there a plan to extend this functionality to Bitbucket as well?

[Laurie Sciutti]

👍🏻

[Tom Hawkins]

In my ACCESS-1468 comment back in August I gave you the benefit of the doubt when I speculated perhaps it was Enterprise FIRST rather than Enterprise ONLY, but I haven't seen a reply from Griffin yet. Which is it please Atlassian / @Vikki Ulmer ? Thanks 

[Vikki Ulmer]

Hi everyone, thank you for your comments and engagement on this post. Our team has published an update to the original post above to help clarify our strategy and address your questions.

Best, Vikki

[Mark Benson]

@Vikki Ulmer - can you expand on the decision to use a different mechanic between enterprise and premium/standard?

Ultimately the end result is the same - non-enterprise admins will go in, take over the rogue instance and either export/import the data into the main company controlled instance or simply delete it.

Why make this more complicated that it needs to be? Is there a legitimate/functional reason why you cannot provide the ability to block this behavior for all subscription levels for customers that also pay for Atlassian Access? 

This seems to be some kind of half baked compromise as the original direction was so poorly received by the community but the overall decision won't be reversed.

[Julien Béchade]

Hi @Vikki Ulmer and thanks for this clarification.

The next APD enhancement will provide org admins with one-click access to ‘join’, or add themselves to, shadow IT instances and take over the management of said instance. 

This will be a great feature addition to Atlassian Access. Do you have an ETA for it though?

But I'm still puzzled that you are not considering adding the product request feature to Atlassian Access though. It makes no sense to be able to provision users to all Atlassian products except for Trello. Or am I misunderstanding this feature?

Cheers.

Julien.

[angus_parrett]

I have had this Feature Request created, be great to get any more potential users who feel this would be great benefit to add to Premium to vote for this please [ACCESS-1651] Premium organisation admins ability to approve or deny the creation of new sites - Create and track feature requests for Atlassian products.

[Vikki Ulmer]

Hi all - we provided an update at the top of this post - but wanted to encourage those interested to read the Atlassian Access community post sharing an enhancement made to Automatic Product Discovery. This enhancement allows org admins to join previously unmanaged user-created products and assume control. 

Thanks, Vikki