Cloud Enterprise admins can now proactively manage product requests

[#1]

Uncontrolled shadow IT, defined as the use of IT-related hardware or software by an individual without the knowledge of the organization's admin or IT department, continues to be a challenge for enterprise customers. It can lead to decreased control of potentially sensitive data and an increased risk of data loss.

Ensuring that enterprise admins have visibility into what shadow IT may exist within their organization is paramount to addressing these risks, as cloud organizations cite lack of visibility (38%) and the inability to enforce security (33%) as two of the top five operational day-to-day headaches they face.

We have received feedback from our enterprise customers and admin community regarding the necessity for more admin controls to tackle this form of shadow IT, and we are excited to announce product requests.

Before product requests, admins had visibility into instances created by managed users in their org through automatic product discovery. With this new feature, action can be taken.

Note: The product requests feature will begin rolling out today, September 12, 2023, and will be available to all Cloud Enterprise customers on September 15, 2023.

How it works:

For Jira Software, Confluence, and Jira Service Management’s Cloud Enterprise plans, product requests allows organization admins to prevent their managed users from signing up for products on their own.

Now, when a user tries to sign up for a product, Atlassian will send that user to a page where they enter details about how they plan to use the product. Admins will review all their users' requests, from the product requests page, and either resolve or deny any instances from being created.

Accessing the feature

Under admin.atlassian.com’s ‘Security tab’, an enterprise admin can now access product requests on the left-hand side of their view.

Admins will now be able to set a policy to either:

• Allow new products: users can create new products outside their current managed organization

• Require admin review: users will submit requests for new products for admins to review and resolve

Reviewing requests:

If an admin selects ‘Require admin review,’ they will begin to see requests come in from their users.

They can review each individual request and determine if it is denied, or under review.

If it is marked under review, we recommend contacting the requestor and determining if the instance is permissible by your organization and should then be created on their behalf.

If the admin marks the request as denied, we will notify the requestor of the denial.

With this new feature, admins gain additional visibility and control to help their organizations quickly take action to proactively monitor user activity and tighten their cloud footprint.

What’s next?

In the current version of product requests, we prioritized denial capabilities as it was our admin focus groups' most requested capability. However, we plan to expand its capabilities in the future for a smoother ‘review’ and ‘approval’ process.

We’d love to hear your thoughts, feedback, and questions about product requests. Leave a comment and let’s chat.

[Darryl Lee]

So Cloud Enterprise, which provides for "Unlimited" instances of Jira/Confluence/JSM is the only tier that prevents rogue instances from being spun up, whereas Atlassian doesn't provide this mechanism to users paying per instance on Premium?

Thanks a lot.

[Bryan Guffey _Sonos_]

Why is this gated to Enterprise? Please explain the technical limitations that make this the case, or why you chose to make this business decision. 

This doesn't seem to align with "No Bullshit" and "Don't F*ck the Customer," or are those values not important anymore? 

[jodi_klein]

Will this be offered to Premium instances?  Not sure why you would limit to just enterprise. 

[Mark Benson]

Echoing what's already been said - pay walling this behind Enterprise tier is a slap in the face to your  smaller customers. There is no good reason that this functionality shouldn't be available across the board... other than greed.

As Bryan has pointed out it seems with every major functionality upgrade/release in cloud Atlassian strays further and further away from it's original "core values". Not sure why you even bother to display these on your website anymore as most of them seem to not be applicable to the bigger projects you've delivered of late.

Seems like it's just become all about the money, and not about actually delivering better software overall.

[noble t trout]

Making a security feature a paywall feature is like... the first rule they tell you not to do when developing a product.

[Dave Liao]

@Vikki Ulmer - Happy this is a feature, but wish it was available to other pricing tiers, and not just Enterprise. 🫠

[Julien Béchade]

Hi @Vikki Ulmer

I'm really at a loss here...
I do not understand why this is not included in Atlassian Access instead since Access is included in the Enterprise plan. It would also make much more sense then since this is related to product access.
We would actually be ready to pay a tad more for Atlassian Access if that feature was part of it.

Could you at least explain the reasoning behind this decision?

Cheers.

Julien.

[CEDRIC DEVAUX]

Hello @Vikki Ulmer 

As you said in your introduction:

Uncontrolled shadow IT, defined as the use of IT-related hardware or software by an individual without the knowledge of the organization's admin or IT department, continues to be a challenge for enterprise customers. It can lead to decreased control of potentially sensitive data and an increased risk of data loss.

So explain us the reason why this feature is only available for Enterprise plan and not for the rest???

Security is a subject to everyone so security applies Standard, Premium and Enterprise Atlassian plan.

We're all concerned about the security of our companies' information, and letting our companies' users create uncontrolled jira, trello, confluence etc. instances is an information leak and therefore a security breach.

[Ilia.Dimitrov]

That is definitely going to help to keep governance of the products under Enterprise Plan.
Would be also very good to have a mechanism to control Bitbucket as we do not have any central management or a way to prohibit registration from managed accounts, for which we have claimed the domain.
Is there a plan to extend this functionality to Bitbucket as well?

[Laurie Sciutti]

👍🏻