• Products
  • Documentation
  • Resources

Invite guests for external collaboration

External collaboration is currently rolling out to select customers as a part of an early access program.

External collaboration is a Confluence feature that lets your team collaborate with people that are “external” in some way, such as clients or contractors. It’s a secure way to open your Confluence instance to anyone you need to work with.

And the way you do this is you invite them as guests.

Guests have limited access to your instance. Unlike regular users who have a broad level of access by default, guests only have access to the spaces to which they have been specifically assigned access.

Guests also have limited access to user information for your regular “internal” users.

The guest designation is instance-wide. In other words, a user can’t be a guest in one space but a regular user in another within the same instance.

Technically, anyone can be made a guest, whether they’re external to your organization or not. For example, if your organization has multiple Confluence instances, an internal member of your organization could be a guest user in one instance and a regular user in another.

Pricing
Guests are only available on the Premium plan and count as licensed users. The license is actually the same — what makes a guest a guest is the systemic guest permission. It’s essentially a role.

In what ways are guests limited on Confluence?

Guests are a different type of Confluence user than a regular Confluence user.

Regular users have broad space access permissions by default. They implicitly have access to all spaces unless explicitly restricted.

Guest users are the opposite. By default, they have no access to any spaces unless explicitly granted it.

Guests have special default space permissions

When given space access, the space permissions guest will have are also limited. By default, they will have the following space permission settings.

Screenshot of what space permissions guests are assigned by default

This is simply what they start with. Guests can be granted any space permission except for the Admin space permission. Guests can’t be space admins.

Granting the Export space permission
This can technically be granted to a guest, but this will only allow guests to export individual pages, not the entire space, because guests can’t be space admins. To export the entire space, you need to a space admin.

Guests have limited access to user info

Guests also have limited access to user information. Confluence blocks their access to the people directory, which contains site-wide user information. Instead, guests can find user information for only the regular users who have access to the spaces the guests have access to.

Functions that query the people directory of the entire site include:

  • @ mentions

  • the People tab in the top nav bar

  • user search

  • user pickers

These are systematically blocked for all guests.

Apps

Guests are restricted from using Confluence’s system apps, including:

  • Analytics (site-level and space-level)

  • Team Calendars

  • Confluence Questions

Guests can, however, interact with page analytics.

Third-party apps

Any apps that that don’t come out of the box with Confluence and have been added manually by you or your organization are third-party apps.

If a third-party app used by your organization is enabled on any pages that guests have access to, then those guests will be able to interact with it.

Guests can’t add or manage any apps.

Macros

Guests can only interact with macros that aren’t at risk for exposing user or site information that isn’t contained to the space the guests are collaborating in.

How guests are identified in Confluence

Along with the limited access that guests have on Confluence, it’s important that you and your internal teams clearly understand who may be external to your organization (guests) and where they have access in Confluence.

This is critical awareness to have so that sensitive information isn’t shared with the wrong people.

To help you know who is a guest and where they have access, Confluence employs a number of markers in the UI.

Individuals
Individual users who are guests will be identified with a GUEST label next to their name wherever they appear in the UI, whether they’ve left a comment or you’re searching for people in any of Confluence’s user pickers.

Groups
Groups that have members who are guests will always have a GUEST label next to the group name, wherever it appears in the UI.

Spaces
Any spaces where guests have access will be called out with a combination of persistent content in the UI and helpful in-product messages (e.g., when you visit a space for the first time since it has been shared with guests).

You’ll also be notified via email whenever a guest or guest group has been given access to a space you have access to.

Confluence admins can see all guests and guest groups that have access to the site by looking in Global permissions > Guest access tab.

Space admins can see all guests and guest groups that have access to their space by selecting Space Settings from the sidebar, selecting General in the Space permissions card, and then scrolling down to the Guest users section.

What governs who is a guest?

Confluence uses a systemic guest permission to limit what guests can see and do on Confluence. This systemic permission is tied to group membership. So guests get their limited access by virtue of being added to a special type of group — a guest group.

When you invite guests to your site, they’ll automatically be added to a default access group for guests, in the same way regular users are added to a default access group (“confluence-users” in the experience that comes out of the box).

You can also create new guest groups and add users. You can add regular users to guest groups, too.

Guests only retain the systemic guest permission as long as the groups they’ve been added to ONLY consist of groups that were created specifically as a guest group.

If they’re added as member of any regular groups, they’ll be given the same access to your site as your regular users have. This is because Confluence’s permissions model incorporates additive permissions.

What additive permissions mean for guest groups

Additive permissions refers to the net access users have, which is the sum of the permissions granted to each of the groups that the user has been added to.

Consider space permissions. If someone is a member of multiple groups in your space (Group A, Group B, Group C), what they're able to see and do in the space is the sum of the permissions granted to Group A + Group B + Group C + any permissions explicitly granted to them on an individual basis (in the Individual Users section of space permissions).

So if you wanted to restrict someone from editing any content in the space, all groups they have membership to that have access to the space (A, B, and C) must be restricted from editing. If even one has permission to edit, then the user will have the edit permission. Simply adding the user to the Individual User section and restricting the edit permission there won’t work.

For guests, this means that if they’re added to any group that has regular access to Confluence, the net access those guests will have will include regular access to Confluence. The system will cease to recognize them as guests and they will not be marked as guests in the UI.

This also means that you can add regular users to a guest group and they’ll still have regular access, assuming they still have membership to regular groups. But if that regular user is removed from all regular groups and only has access to guest groups, then that regular user will effectively become a guest, and will be marked as a guest in the UI.

To change group membership, you need to be an organization or site admin.

Invite a guest to your site

Only organization or site admins can invite guests to Confluence.

The first step in getting guests set up and collaborating on your Confluence site is to invite them. This is the same process for inviting regular users.

To invite a guest:

  1. In the sidebar menu of Atlassian Admin for your site, go to Users in the USER MANAGEMENT section.

  2. Select Invite and choose Guests.

  3. Add the email addresses of the guests you want to invite

  4. (Optional) Assign the people you’re inviting to specific groups. (All guests invited will be added to the site’s default guest access group. This step is for if you want to go ahead and add them to any additional guest groups that may have been created for specific purposes. If you add them to groups that already have access to any spaces, the newly invited guests will also have access to those spaces.)

  5. (Optional) Personalize the email invite that the guests will receive.

  6. Select Invite users.

It’s a two-step process
At this point, the guests have been invited, but they may not have access to any spaces, yet. Without access to at least one space, guests won’t be able to collaborate. So you may have one more step to complete. See Assign guests to spaces.

To assign space access immediately after inviting guests:

  1. Select the Configure space access link in the confirmation message that pops up. You’ll find this message in the bottom left of your screen immediately after completing the invite process. This will open Confluence’s global permission, with your guests' information pre-filled in the Add space access dialog.

  2. Choose up to 5 spaces to give these guests access to.

  3. Select Done.

This is useful for when you know ahead of time which spaces these guests need access to.

If you don’t know yet, that’s okay! You can assign space access later in global permissions.

Confluence admins and space admins can also assign space access for invited guests. Just be sure they know when they’re free to do it — they aren’t notified within Confluence.

Removing guests from your site is the same as removing any user.

Manage space access for guests

There are a few different ways to keep track of your guests and what spaces they have access to, as well as to change their access.

As a reminder, guests need to be invited to the site before they can be granted access to spaces.

To free up guests to start collaborating on Confluence after they’ve been invited to the site, they first need to be given access to the spaces they should be collaborating in. There are 3 ways to do this.

Assign spaces from global permissions

  1. Go to Global permissions.

  2. Select the Guest access tab.

  3. Select Add space access.

  4. In the dialog that appears, add the guests or guest groups you want to assign space access to.

  5. Choose up to 5 spaces to give the selected guests or guest groups access to.

  6. Select Done.

You can also assign space access to guest and groups by going to the guest’s or group’s details page.

To assign space access for a single guest or guest group:

  1. Go to Global permissions.

  2. Select the Guest access tab.

  3. Search or browse to find the guest group you want, then select the More actions menu (•••) > Add space access.

  4. Choose up to 5 spaces.

  5. Select Done.

Assign spaces from space permissions

The process for adding and managing space access for guests is the same as it is for regular users, except you’ll add guests and guest groups to the space in the Guest users section of space permissions.

Guests and guest groups can’t be given the space admin permission.

View and manage space access in user, group details

Organization admins and site admins can see all spaces guests and guest groups have access to (and change that access) by going to the guest’s or guest group’s details page.

To view a guest’s and guest group’s details:

  1. Go to Global permissions.

  2. Select the Guest access tab.

  3. To view a guest group’s details, search or browse to find the group you want in the table. On its line item, select the More actions menu (•••) > View details.

  4. To view an individual guest’s details, expand a group they’re a member of and find the guest. On their line item, select the More actions menu (•••) > View details. (You can also simply select the guest’s name.)

Space admins can see all guests and guest groups that have access to their space in Space permissions.

Manage guests' access to pages

The process for managing page access for guests is the same as it is for regular users.

Last modified on Oct 20, 2021
Cached at 7:03 PM on Oct 27, 2021 |

Additional Help