2.1 Atlassian Organizations, Domain Verification & Managed Accounts

2.1 Atlassian Organizations, Domain Verification & Managed Accounts

Quick Summary: In Atlassian Cloud, the Organization (admin.atlassian.com) sits at the pinnacle of the governance hierarchy, acting as the centralized umbrella for domain verification, user identity, billing, and multi-site administration. Verifying domain ownership (DNS or HTTPS file upload) and then claiming the accounts turns them into managed accounts, empowering Organization Administrators to enforce centralized security policies, terminate sessions, manage API tokens, and control user lifecycles across all linked Jira and Confluence sites.

---

The Atlassian Organization Architecture

Unlike traditional on-premises Jira Server or Data Center environments where a single application installation houses both the user directory and project configurations, Atlassian Cloud separates identity and organization management from individual application sites.

An Atlassian Organization is an administrative container hosted at admin.atlassian.com. It provides enterprise administrators with a unified console to oversee:

1. Multiple Cloud Sites: A single organization can link dozens of distinct cloud sites (such as acme-corp.atlassian.net, acme-it-servicedesk.atlassian.net, or acme-dev-sandbox.atlassian.net).
2. Product Subscriptions & Unified Billing: Consolidated invoicing, subscription tier management (Standard, Premium, Enterprise), and license allocation across Jira Software, Jira Service Management, Jira Product Discovery, and Confluence.
3. Centralized User Directory: A single directory listing every user who interacts with any linked site, differentiating between internal corporate personnel and external collaborators.
4. Security Governance: Enterprise authentication policies, SAML 2.0 Single Sign-On (SSO), System for Cross-domain Identity Management (SCIM) directory syncing, and organization-level audit logs.

+-------------------------------------------------------------------------+
|                       ATLASSIAN ORGANIZATION                            |
|                        (admin.atlassian.com)                            |
|  - Verified Domains (acme.com)         - Centralized Billing            |
|  - Managed User Accounts               - Organization Audit Logs        |
|  - Authentication Policies (Atlassian Guard: SAML SSO, SCIM, 2FA)       |
+-------------------------------------------------------------------------+
                                     |
         +---------------------------+---------------------------+
         |                                                       |
         v                                                       v
+-----------------------------------+   +-----------------------------------+
|            CLOUD SITE 1           |   |            CLOUD SITE 2           |
|    acme-core.atlassian.net        |   |    acme-service.atlassian.net     |
|  - Jira Software (Cloud)          |   |  - Jira Service Management (Cloud)|
|  - Confluence (Cloud)             |   |  - Jira Product Discovery         |
|  - Site Administrators            |   |  - Site Administrators            |
|  - Local Product Access Groups    |   |  - Local Product Access Groups    |
+-----------------------------------+   +-----------------------------------+

Why Multi-Site Linking Matters

In large enterprises, spinning up independent cloud instances often leads to shadow IT, fractured billing, and disjointed user management. By linking multiple sites to a single Atlassian Organization, administrators eliminate these silos. Users keep a single Atlassian identity across all sites, while the organization retains centralized control over billing, compliance, and security policies.

---

Domain Verification: The Foundation of Identity Control

Before an organization can govern corporate user accounts, it must establish cryptographically verifiable ownership over the email domains associated with those users (e.g., @acme.com). Domain verification proves to Atlassian that your organization legitimately owns and controls the domain name.

Verification Methods

Atlassian provides two supported methods to verify domain ownership within admin.atlassian.com (Security > Domain verification > Add domain):

One Domain, One Organization

Each email domain is verified by the organization that owns it, and domains are listed under Directory > Domains in Atlassian Administration. If a subsidiary uses its own domain (for example, fintechlab.io), that domain must be verified separately before its accounts can be claimed.

Good practice: Leave the TXT record or verification file in place after verification, so the proof of ownership stays available for the controls that depend on it.

---

Managed Accounts vs. Unmanaged / External Accounts

Verifying a domain proves ownership. To make accounts managed, you then claim them (see "Claiming Accounts" below). Accounts on a verified domain that you haven't claimed are still treated as external users.

Managed Accounts

A Managed Account is an Atlassian identity whose email address belongs to a verified domain owned by your organization. The organization holds complete administrative custody over the account lifecycle.

Organization Administrators can:

• Edit account profile details (full name, job title, department, and profile picture) directly from the centralized directory.
• Terminate active web, mobile, and desktop sessions across all Atlassian Cloud applications instantly.
• Enforce corporate authentication policies (mandatory SAML 2.0 SSO, strict session timeouts, and two-step verification).
• Revoke individual API tokens generated by the user.
• Deactivate the account: Suspends the user's ability to log in anywhere in Atlassian Cloud, immediately revoking product access across all sites while preserving issue assignment, historical comments, and audit records.
• Delete the account: Permanently erases personal data to satisfy regulatory compliance (such as GDPR "Right to be Forgotten"), anonymizing the user identifier throughout Jira.

Unmanaged and External Accounts

An Unmanaged (External) Account is any user identity registered with an email domain that has not been verified by your organization. Common examples include external contractors (contractor@consultingfirm.com), technology partners, or personal webmail accounts (freelancer@gmail.com).

Because your organization does not own their email domain, your administrative authority is strictly limited to their local site and product permissions:

• You cannot reset their password, force SAML SSO authentication, update their profile metadata, or revoke their personal API tokens.
• You cannot deactivate or delete their Atlassian account from admin.atlassian.com.
• You can only revoke their site access or remove them from local product groups (e.g., jira-software-users), preventing them from accessing your specific cloud instance.

---

Administrative Roles: Organization Admin vs. Site Admin

The ACP-120 exam requires clear differentiation between the administrative tiers in Atlassian Cloud. Confusing Organization Admin duties with Site Admin duties is a frequent source of candidate errors.

Organization Administrators (admin.atlassian.com)

Organization Administrators represent the highest tier of security and administrative authority across the entire Atlassian footprint. They are enterprise architects and security operators.

Exclusive Responsibilities:

• Verifying corporate domains and managing DNS verification tokens.
• Managing Atlassian Guard subscriptions and configuring enterprise Identity Providers (IdPs).
• Designing and assigning Authentication Policies (SSO, 2FA, session durations).
• Managing the Organization Audit Log (tracking identity changes, policy updates, and cross-site access).
• Managing organization-wide user lifecycles (claiming, deactivating, and deleting managed accounts).
• Managing billing, payment methods, and subscription tiers across all linked sites.
• Granting or revoking administrative access to any linked site (an Org Admin can promote themselves or others to Site Administrator on any linked site at will).

Site Administrators (<site>.atlassian.net)

On organizations that haven't moved to centralized user management, a site admin role manages users and app access for one site. (Organizations on centralized user management use roles such as user access admin instead.) Either way, this is user and access administration, not Jira configuration.

Core Responsibilities:

• Inviting new users to the specific site and assigning them to product access groups (e.g., jira-software-users, confluence-users).
• Managing group membership, including the jira-administrators group that carries the Administer Jira global permission.
• Granting and removing app access (for example, Jira or Confluence) for users and groups on that site.

Scheme design, workflows, fields, and project creation are Jira admin work. A site or org admin who needs to do them first adds themselves to jira-administrators, which grants the Administer Jira global permission.

Site Admins Cannot:

• Verify or delete corporate domains.
• Configure SAML SSO or SCIM directory connections in Atlassian Guard.
• Deactivate a managed user's global Atlassian account (they can only remove the user from local site groups).
• View organization-level audit logs spanning other corporate sites.

Audit Log Segregation

Administrative actions are recorded in two separate audit facilities:

1. Organization Audit Log (admin.atlassian.com > Security > Audit log): Captures high-level identity, security, and governance events across all sites—such as domain verification attempts, SAML configuration edits, authentication policy changes, managed account deactivations, API token revoking, and Org Admin privilege grants.
2. Jira Audit Log (Jira Settings > System > Audit log): Captures Jira configuration events on that site, such as project creation and deletion, scheme changes, workflow updates, custom field changes, and permission changes.

---

Claiming Accounts After Verification

A common enterprise scenario involves pre-existing Atlassian accounts. When employees sign up for Trello, Bitbucket, or free Jira sites with their corporate email addresses (user@acme.com), Atlassian creates accounts that the employees own.

Verify, Then Claim

In current Atlassian Administration, managing those accounts takes two steps:

1. Verify the domain (DNS TXT record or HTTPS file), in Directory > Domains.
2. Claim the accounts for that domain. Atlassian offers two approaches:
   • Claim all accounts: Atlassian claims every account on the verified domain.
   • Claim some accounts manually: you decide which accounts to claim, for example by uploading a CSV list.

You can also set the domain's claim setting to claim new accounts automatically. Choose this if you provision accounts with SAML just-in-time provisioning. Automatic claiming applies to accounts created after you switch it on.

What Changes When an Account Is Claimed

1. Ownership moves to the organization. Org admins can edit, deactivate, or delete the account.
2. Security policies apply. Newly claimed accounts are added to the organization's default authentication policy, so SSO or two-step verification requirements apply at the user's next login.
3. Unclaimed accounts stay external. An @acme.com account that hasn't been claimed is still treated as an external user, even though the domain is verified.

Exam Tip: Claiming accounts does not automatically grant those users access or licenses to your Jira Cloud sites. Product access requires explicit membership in product access groups (e.g., jira-software-users). Domain verification governs identity and authentication, not product licensing.