Users getting Access to Jira Work Management automatically

[Brian Taylor]

We have a use case where a user creates an Atlassian account and selects our Jira Work Management product.  They are automatically added to the default JWM group jira-work management-users-xx.  We have Okta enabled, which does prevent them from accessing any projects.  However, we want to not allow users to automatically gain access.  Is there some sort of approval that can be put in place or some other method that does not grant access to the default groups?

[Kieren _SmolSoftware_]

We have a use case where a user creates an Atlassian account and selects our Jira Work Management product.  They are automatically added to the default JWM group jira-work management-users-xx

It sounds like you have an approved domain setup for the Jira Work Management product. Go to: admin.atlassian.com -> Products -> User Access Settings and check if you have JWM setup as a product for 'Any Domain' or your company domain.

You can do two things to help with this:

1. Change your approved domain for JWM to be 'Admin Approval' ticked as yes. This means that when a user tries to access your JWM product, they'll have a 'Request Access' screen presented to them. They can press the 'Request Access' button, which will notify your organisation admins that the user wants access to the product, and add that users into the Request Access list (to see this list, go to admin.atlassian.com -> products -> select the site -> Access Requests. You can approve or deny them access, approving access will put them into the default JWM product group.

2. Remove the approved domain for JWM and implement an external access request process. Jira Service Management would be good for that, or Zendesk or ServiceNow... Lots of products out there.

There's a whole other issue if you're looking to sync users from your IDP into the default groups... Let me know if that's what you're after?

-Kieren
Co-Founder @ Smol Software | Ex-Atlassian

[Kieren _SmolSoftware_]

We've released an app to give admins some automation tools. In the case of customers with IdPs where they only want users to be granted product access via their IdP, you can sync users from an IdP group into your default product access groups. The Admin Automation app can automatically add or remove users from any group into another group, and to solve other challenging and time consuming admin tasks. Some other examples:

1. You can remove any user from jira-users-* or confluence-users-*, if they're not in your special 'All users' group. This is a simple and quick way to ensure that, no matter which other invite features are turned on, users cannot get access to any products without being in your 'key' group.
2. You can sync users from the jira-users-* group into the confluence-users-* group, ensuring that Jira users always have access to Confluence as well.

Hopefully the app can help you @Brian Taylor and anyone else reading this thread!

-Kieren
Co-Founder @ Smol Software | Ex-Atlassian