Skip to main content

Atlassian Support

  • Products
  • Documentation
  • Resources
  • Contact us
  • Sign in
  • Sign in
Security and access policies
Security and access policies

Documentation

  • Learn about security solutions and standards
    • How to keep my organization secure?
    • Understand Atlassian Guard
    • Atlassian Guard app and plan availability
    • Supported security protocols for Atlassian cloud apps
  • Configure authentication policies for your organization
    • Understand authentication policies
    • What is a default authentication policy?
    • What is a non-billable policy?
    • Edit authentication settings and members
    • Authentication policy settings for your organizations
  • Configure single sign-on for your organization
    • Configure SAML single sign-on
      • Configure SAML single sign-on with an identity provider
      • Configure SAML single sign-on for portal-only customers
      • Configure SAML single sign-on with AD FS
    • Require users to log in with Google
  • Configure settings for secure user login
    • Manage your password policy
    • Enforce two-step verification
    • Update idle session duration
    • Configure your organization’s login page
    • Set mobile app session expiration
    • Report and track data across your organization
      • Gain insights into app usage and security practices
      • Track storage and move data across apps
      • Export user accounts
        • Export users from a site
        • Export managed accounts
        • Export accounts from domains
      • Track user API tokens in your organization
        • Understand user API tokens
        • View user API tokens
        • Revoke user API tokens
    • Manage data residency
      • Understand data residency
      • Move product data to another location
      • Moving your Marketplace apps data to another location
    • Maintain secure access to apps
      • Specify IP addresses for app access
      • Manage your organization's Marketplace and third-party apps
      • Manage third-party contacts
      • Mobile App Management for Atlassian mobile apps
        • Security settings in a mobile app policy
        • Create a mobile app policy
        • Edit a mobile app policy
        • Delete a mobile app policy
        • Test a mobile app policy
        • What will my users experience when I set a mobile policy?
      • Mobile Device Management (MDM) for Atlassian mobile apps
        • Create an AppConfig JSON string for iOS
        • What are the AppConfig settings for my MDM?
        • MDM security controls and supported apps
      • What happens when third-party apps access third-party websites?
    • Classify your organization’s data
      • What is data classification?
      • What can users classify?
      • Manage classification levels
        • Create a classification level
        • Customize a classification level
        • Publish a classification level
        • Archive a classification level
        • Restore a classification level
      • Understand default classification levels
        • What is a default classification level?
        • Set a default classification level
    • Control how users outside your organization access apps
      • Understand external user security
        • Who are external users?
        • What is external user security?
        • What is an external user security policy?
        • Available external user security policy settings
        • What is API token access?
      • Edit external user security settings
        • Make external user policy non-billable
        • Block user API token access
        • Add test policy
        • Export external users
        • Reset sessions for external users
        • Apply authorization method
        • Update session expiration
        • Edit external user policy
    • Detect, investigate, and respond to threats
      • What is Guard Detect?
      • Add Guard Detect to your organization
      • Add people to Guard Detect
      • Manage detections
        • What user activity is detected?
        • What sensitive data is detected?
        • Exclude a page from a detection
        • Exclude a user from a detection
        • Create a custom detection
        • Request a new system detection
      • Manage alerts
        • View an alert
        • Get more or fewer alerts
        • Track the status of an alert
      • Send alerts to your own tools
        • Send alerts to Slack
        • Send alerts to Microsoft Teams
        • Send alerts to a SIEM or other tool
        • Send alerts to Jira
        • Send alerts to Opsgenie
        • Send alerts to Splunk
      • Investigate and remediate an alert
      • Respond to alerts
        • Create an automation rule
        • How does automation work with Guard Detect?
        • Redact sensitive data from Confluence
        • Redact sensitive data from Jira
        • What happens when data is redacted?
      • Guard Detect frequently asked questions
    • Manage bring your own key encryption
      • Manage your encryption
        • Use Customer-managed keys (CMK) encryption
          • What is CMK encryption?
          • Set up AWS account and create a KMS key policy
          • Set up CMK-enabled Atlassian apps
          • Update AWS KMS key policy for your Atlassian cloud organization
          • Revoke Atlassian access to your KMS encryption keys
          • Restore access to your CMK encryption keys
          • Request CMK re-encryption
        • Use Bring Your Own Key (BYOK) encryption
          • What is BYOK encryption?
          • Set up an AWS account and create an IAM role
          • Set up BYOK encryption
          • Revoke access to your BYOK encryption keys
          • Restore access to your BYOK encryption keys
          • Request BYOK re-encryption
          • BYOK encryption limitations
        • Data managed with encryption
        • Encryption frequently asked questions
      • Monitor and audit activity in your organization
        • What activities does the audit log include?
        • View audit log activities
        • Export audit log
        • Send audit log activities to another tool using a webhook
        • Audit log activities database
      • Secure your organization's data
        • What is a data security policy?
        • Create a data security policy
        • Edit a data security policy
        • Deactivate or delete a data security policy
        • Manage data security policy rules
          • Prevent data export
          • Prevent public links
          • Prevent anonymous access
          • Block third-party app access
          • Third-party app access rule coverage summary
          • Apps that cannot be blocked by app access rules
          • Third-party app access rule coverage summary for Confluence Cloud
          • Third-party app access rule coverage summary for Jira Cloud
      1. Atlassian Support
      2. Security and access policies Resources
      3. Control how users outside your organization access apps

      Understand external user security

      Defines external users and explains the available external user security settings.

      • Who are external users?

        Understand the definition of an external user and how to manage external user access to your Atlassian products.

      • What is external user security?

        Discover how external user security helps you protect data in your organization.

      • What is an external user security policy?

        Apply security settings for external users, make a policy non-billable, and test settings for your organization.

      • Available external user security policy settings

        Discover the external user security settings that apply to all external users in your Atlassian organization.

      • What is API token access?

        Understand how to set and update API token access for external users in a policy.

      Was this helpful?

      Still need help?

      The Atlassian Community is here for you.
      Ask the Community
      • Explore more
      • Who are external users?
      • What is external user security?
      • What is an external user security policy?
      • Available external user security policy settings
      • What is API token access?
      • Control how users outside your organization access apps
      • Understand external user security

      • Edit external user security settings
      CommunityQuestions, discussions, and articles
      Atlassian Logo
      • Accessibility
      • Notice at Collection
      • Privacy Policy
      • Terms of Use
      • Security
      • 2025 Atlassian