Adding external partners to a Jira project

[Pradeep Nene]

We have a newly created team managed project, to which there is a request to add external partners. We provision & authenticate Atlassian cloud apps via Okta. Now, although Jira allows to add external users, how would they authenticate as our authentication is managed via Okta? Is there any way to by pass Okta authentication or we will have to create corresponding Okta users for our partners?

[Walter Buggenhout · Accepted solution]

Hi @Pradeep Nene,

From my own experience as an Atlassian consultant: both scenarios occur and are technically supported. I see both customer instances where dedicated accounts are created in the internal directory (Okta, Azure AD, ...) for the time being. In other instances I am accessing with an Atlassian ID not listed in the company directory. It all comes down to the policies you prefer, I suppose.

Hope this helps!

[Pradeep Nene]

Hi @Walter Buggenhout , yes, I decided to create internal Okta users to let these external folks access our Jira project. This way they will have to accept our compliance & security policies for access which will be a binding on them.

On other hand, I will be interested in knowing how someone external to an organization can access a Jira project without authenticating via Okta (or any other IdP). Can their own (external user's) Atlassian credentials work to access the Jira project just because they were added to that project by the other organization?

Thanks for your response.

[Walter Buggenhout]

Hi @Pradeep Nene, yes of course. There is a difference between access to your site (the authentication part that you've already covered) and access to product features, such as access to a project.

Every Jira project has its own, separate permissions. If your projects are company managed, then granting a user browse project permission provides the ability to see the issues in that project. An extensive set of additional permissions allows you to expand those permissions at a very granular level.

Best practice is to use or set up permission roles that group a set of permissions for e.g. a developer, a project manager, a viewer, ... You then assign users (or even better: user groups) to those roles inside your project. It does not matter which directory they are authenticating from.

Have a look at this support article on managing permissions for a more elaborate explanation on how to set things up. 

[Pradeep Nene]

@Walter Buggenhout thanks for sharing & I appreciate your help.