Current Behavior & Business Case

Currently, an admin's domain is automatically added to Approved domains with the User role for a Jira instance via Domain-Enabled Signups (DES) when they first go through the onboarding flow for Jira on an instance that has <=1 Project. This is done without any notification or confirmation from the admin, which represents a security concern for many customers in regulated industries or whose company policies otherwise require strict access controls.

• This logic may be changing in the near future to only trigger adding the domain to Approved domains via DES on newly-provisioned Jira instances, but the lack of ability for admins to control the behavior remains a security concern for the same cohort of customers.

Desired Behavior

To support our more security-minded customers, Atlassian should provide organizations with a setting that admins can toggle to disable this behavior. This setting would prevent any domains from being added to Approved domains without the explicit consent and acknowledgement of an organization admin.