Removing the Single Email Address field in Jira Notification Schemes

[#1]

Hi Atlassian Community,

In our ongoing efforts to ensure the security of our users, we have decided to deprecate the Single Email Address field in Jira Notification Schemes for Jira Cloud.

The deprecation process will begin on 15 August 2023. After this date, the Single Email Address field will no longer be available in Jira Cloud, and any existing Single Email Address recipients will stop receiving emails. Please take the necessary steps to update your notification schemes and related integrations, and take a backup of current recipients before the deprecation date.

What is this "Single Email Address"?

In Jira Notification Schemes, the Single Email Address field currently allows issue notifications to be sent to any email address, even if it is not associated with an Atlassian account.

While this feature has been useful for many users, it also presents security concerns due to its unrestrained limits. Specifically, it could be maliciously exploited to send spam to any email address, resulting in potential security violations and negative user experiences.

What's changing?

To address these concerns, we have made the decision to remove the Single Email Address field from Jira Notification Schemes.

Learn more about how this affects the Notification Scheme APIs.

What are the alternatives?

If you want to continue sending notifications to external emails, we recommend:

1. Jira Automations: With Jira Automations, you can create custom rules that sends notifications to external email addresses. Jira Automations is available in all our plans, however, there are limits on the number of automation executions per month, depending on your subscription.

2. ScriptRunner: This is a third-party Marketplace app which provides advanced scripting capabilities that can also be used to send issue updates to non-Atlassian emails, however, please note that this is a paid app and may involve additional costs for your organization.

3. Notification Assistant for Jira: This is another paid third-party Marketplace app with extended email notification configuration options to support sending issue notifications to non-Atlassian emails.

We appreciate your understanding and cooperation in this matter. Our primary goal is to ensure the security and privacy of our users and maintain a high-quality experience for everyone.

[Sanjen Bariki]

Hi @Eric Zheng ,

Good😊

[Mike]

Where exactly is the page shown in the screenshot? How do I navigate to it to see if we are using it? I believe ours are all setup using automations but I need to be sure.

[Jesse Brooks]

@Mike

It looks like it's under the settings gear in the top right -> Issues -> Notification Schemes in the bottom left.

@Eric Zheng

We are currently using the single email address and Group options. If I remove the single email address entry to accommodate this change, will the group notification option continue to function as expected? 

[Eric Zheng]

Hey @[deleted] ,

As Jesse mentioned above, you can navigate to the Notification Schemes page ("under the settings gear in the top right -> Issues -> Notification Schemes in the bottom left"), and have a look through the schemes that have been set up. Within these schemes, a field will be shown for those who are receiving notifications due to the Single Email Address field. 

[Eric Zheng]

Hey @Jesse Brooks ,

Group notification options will continue to be supported and function as expected. Let me know if you have any further questions!

[Mike]

@Eric Zheng @Jesse Brooks 

Thanks for that. It looks like we're only using 1 Single Email Address field and I think the recipient is defunct now.

[Satchidanand_CS_ext]

Hi @Eric Zheng , I used this feature in Data Center but the email is not sent any reason why it may be blocked

[Andrzej Kotas]

hi @Satchidanand_CS_ext in DC environment the prerequisite would be the same so you'll need to check first if the issue is publicly viewable 

A single email address notification will only be sent if the issue is publicly viewable (as the email address of a non-Jira user could be specified, in which case a security check is not possible). Publicly viewable issues are issues which have a Permission scheme that gives the 'Browse Projects' permission to 'Anyone' (any non-logged-in users). The text template is used for notifications to a single email address.

[Saralie S.]

Thank you for the update!

[Sanjen Bariki]

Thank you for the Explain step by step

[Suraj Yanpallewar]

Thanks for the information..