ACP-520 Atlassian Cloud Organization Admin Certification Questions and Answers

Currently, you can only create one sandbox for each linked product 1 . Since you have only two products (Jira Software and Confluence), and you already have a sandbox for Confluence, you cannot create any more sandboxes for your organization.

References :  Manage product sandboxes

When you copy data from production to a sandbox, the user permissions and groups are also copied. This means that project admins from production can access and manage the same projects in the sandbox. However, customers and agents from production cannot log into the same portals or projects in the sandbox, because we disable app links, external email notifications, and integrations with Bitbucket and Slack. Attachments and comments are also not copied to the sandbox, unless you choose to copy with media files.

References  =  Manage product sandboxes ,  Copy data to sandbox

The status “Active” means that the user has an active account and can access the products they have been granted access to 1 . It does not imply anything about the user’s group membership, account type, last login time, or product access.

References :

Manage users in your organization

For Atlassian Access billing, users on paid plans, like the Confluence Enterprise plan, are included in the bill. Atlassian Access provides security and centralized administration across all Atlassian Cloud products. Users on free plans, deactivated accounts, and portal-only customers (who typically access only a service desk portal and do not use licensed seats) are not counted as billable users for Atlassian Access.

When you start a site with a Premium subscription trial to a Cloud product, you automatically create a “site-admins” group that contains your account as the only member. The “site-admins” group has the site admin role, which allows you to manage the site settings, products, users, and groups. You can also add other users to the “site-admins” group if you want to delegate some of the site administration tasks.

References  =  Create and update groups  and  Manage site-level permissions

The Billing page shows you the number of billable users for each product on your site, as well as the user tier and the monthly cost. You can filter by product and site to see the specific details for Jira Software on “acme.atlassian.net”.

References :

How to prepare for ACP-520: Atlassian Cloud Organization Admin Certification , section “Manage product subscriptions & billing”

Manage your bill for Standard and Premium plans, subsection “View your bill”

Permission schemes control who can see and do what in Jira projects. If the org admin changed the permission scheme for the project that Jack was working on, it could affect his visibility and access to the issues.

References :

How to prepare for ACP-520: Atlassian Cloud Organization Admin Certification , section “Users and Groups”

Manage project permissions

This is because the access request shown in the image is for Confluence and the reason stated is “Needs to access Confluence”. Hence, Monica is granted the User role for Confluence, which allows her to view and edit pages and spaces in Confluence. She is not granted access to any other products or any Product Admin roles, which require higher permissions. She is also added to only one default group, which is the confluence-users group, unless the site admin has changed the default group for Confluence.

References  = [Approve or deny product access requests], [Manage product access]

If you want to manage users and groups from both corporations in a single location, you need to consolidate your Atlassian Cloud organizations. This can be done by transferring all product instances in one organization to another.  After the transfer, the unwanted organization is deleted 1 .  This feature is called Transfer products and it is available from the organization settings 2 .

The other options are not features that can help you merge your organizations.  Organization insights is a feature that provides analytics and reports on your organization’s users, products, and security 3 .  Release tracks is a feature that allows you to choose when your cloud products receive new features and improvements 4 .  Verify domains is a feature that allows you to manage the Atlassian accounts of your users and apply security policies to them 5 .  Identity providers is a feature that allows you to integrate your organization with external identity services, such as SAML or SCIM 6 .

References  :

Should I merge my Atlassian organizations?

Transfer all products to another organization

View organization insights

Choose a release track for your cloud products

Verify a domain to manage accounts

Manage users from your identity provider

Shadow IT refers to the product creation and usage administered outside of an organization’s IT department, which can lead to unexpected costs, security and compliance concerns, and operational complexity 1 .  Atlassian Access is a service that provides enhanced security and governance features for Atlassian Cloud products, such as SAML SSO, user provisioning, enforced two-step verification, and audit logs 2 .  Atlassian Access also offers a feature called automatic product discovery, which helps admins discover and manage the shadow IT products created by their managed users 1 .

A managed user is a user whose account is on a domain that is verified by an organization 3 .  A verified domain is a domain that an organization has proven ownership of by adding a DNS or HTTPS record 4 . For example, if an organization verifies the domain acme.com, then any user with an email address ending with @acme.com is a managed user of that organization.

A product is an instance of an Atlassian Cloud product, such as Jira Software, Confluence, Bitbucket, or Trello 5 .  A product belongs to a site, which is a collection of products that share a URL and administration settings 6 .  A site belongs to an organization, which is a way to group and manage multiple sites and products under one central admin console 7 .

A managed user can create a product in another Cloud organization by using their work email address to sign up for a new site or join an existing site that is not owned by their organization 1 . This creates a shadow IT product that is not visible or controlled by their organization’s admins.  Atlassian Access can discover these shadow IT products by scanning the domains of all Atlassian Cloud products and matching them with the domains of the organizations that have Atlassian Access enabled 1 . Atlassian will proactively send an email to the organization admins with the number of shadow IT products created by their managed users and what the exact shadow IT product is.  Within admin.atlassian.com, organization admins can also view additional information, such as the owner of these products, how many users are in that product, and the date it was created 1 .

Therefore, the statement that explains how Atlassian Access discovered shadow IT is that one of your managed accounts created a product in another Cloud organization.

References  :

Automatic product discovery in Atlassian Access

Atlassian Access: Enhanced Cloud Data Security & Governance

What is a managed account?

Verify a domain to manage accounts

What is a product?

Understand Atlassian sites and organizations

What is an Atlassian organization?

When you click “Grant access to Jira Software” in the access request, the user is granted access to Jira Software only. They are not added to multiple product access groups, granted the User role for Jira Software, added to only one default group, or granted any Product Admin roles.  References :  Manage product access , [Manage users and groups]

The Product admin role for Jira Administration is only available for groups that have access to Jira Software 1 . The “confluence-admins” group does not have access to Jira Software by default, so you cannot grant them this role.  You can only grant this role to groups that have the Jira Software User role or the Jira Software Admin role 2 .

References :

Manage groups

Manage product roles

Adding an upstream port is one of the configuration steps that must be done in a self-managed instance to enable a secure pathway between a self-managed Jira Software instance and several Atlassian Cloud products. An upstream port is the port on your self- managed instance that receives traffic from the application tunnel. You need to configure the upstream port for each product that you want to connect to the tunnel.

References  =  Configure required connections and upstream ports  and  Create an application tunnel to your self-managed instance

Each site in an organization must have a unique name and URL. You cannot have two sites with the same name or URL in the same organization.

References Add a new product to your organization   Update a product URL to a new URL

When you add a domain to user access settings, you can specify the default product role for each product in your organization. This determines the level of access that users with verified email addresses from that domain will have when they join your site. If you set the product role to None, users will not have access to that product unless you manually grant them access later.

References Specify how users get site access   User access settings