Enforcing Policies for External users from other Atlassian Orgs

[Rebekka Heilmann (viadee)]

Following scenario:

I am Org Admin of OurOrg. We have Access and enforce SSO for our AD/Managed Accounts. External Users require 2FA
Our Customer has similar settings in their Org, CusOrg, also using Access.
We work together closely. Some of their Users are accessing our Confluence as Guest Users. I am also Org Admin & User in their Atlassian products.

When I log into their products, I would have expected to fall under their External User policies. However, I don't need to reauthenticate, as our policies seem to apply. The other way around, their users will authenticate against their IDP when accessing our Confluence.

It seems like the Managed Users will always fall under their Home Org Authentication policies.

That's fine in our case, as we have similar restricted policies. I am wondering what would happen, if either of the Orgs had less "safe" policies.

I couldn't find any official documentation on this behaviour.

[Rebekka Heilmann (viadee) · Accepted solution]

With extended test period it now makes more sense.

In my case, I am authenticated in our Org (with SSO) and then have to enter a 2F (as configured in the External policy) when I access their Org.

So works as expected I would say. Just a bit confusing and not really explained well in any documentation.

[Gallus Thoma · Accepted solution]

Hi Rebekka

please check this page
https://support.atlassian.com/security-and-access-policies/docs/control-how-users-outside-your-organization-access-products/

and this
https://support.atlassian.com/security-and-access-policies/docs/available-external-user-security-settings/

does it help?