JSM portal customers hit "allow access on your behalf" consent — asApp-only app

Forge
1

Since ~12 June 2026, all JSM portal-only customers opening our Forge app (jiraServiceManagement:portalUserMenuAction, unlicensedAccess: [customer]) get a Forge “Access required — allow the app to access Atlassian products on your behalf” dialog. Clicking Allow access sends them to an atlassian.com login they can’t complete, so the app is hard-blocked for every customer.

The app is asApp()-only — no asUser() calls, no frontend product calls. Scopes/manifest are unchanged; we redeployed an older build with an identical manifest and it still happens, so it’s not our code. It lines up exactly with the 12 June “JSM Customer Account Support” changelog. Opening the app fires the new …/customer/.../forge/context-token endpoint, then the resolver invokes — all HTTP 200, so the gate is platform-side, not our resolver.

Per Access to Forge apps for unlicensed users, asApp() for customers is allowed without per-user consent — so why are customers being prompted?

Questions: Is this expected from the new rollout? How is an account-less portal customer meant to complete it? Is there any opt-out or manifest setting to stop prompting customers? This is blocking all customer access to a previously working app.

2

Hi Adam,

Thanks for raising this concern. Can you try re-deploying the app once?
Although the release should not impact currently working flows, if your app is hosted on Forge remote, it might be possible that it would need a re-deployment.

3

@AdamKassoff If this is a Forge native app, can you set the app distribution to Sharing in Developer console?

4

Hi,

Thanks. Two follow-ups:

  1. Already redeployed — we’ve now redeployed the app twice (latest version 5.36.0) and the “Access required / allow access on your behalf” prompt still appears for all portal customers. It’s a Forge native app (Forge-hosted resolver functions, no Forge Remote / no remotes block), so the remote-redeployment case shouldn’t apply.
  2. Distribution = Sharing — before we change this, could you clarify why the app’s distribution setting would affect the customer consent prompt? We’d like to understand the mechanism, since switching to Sharing broadens who can install the app and we want to make sure it’s the right lever rather than a side effect.

Thanks!

5

For 2, if the app isn’t set to shared, it’s intended to be used only by the app developer. That’s why users are being asked for consent (it’s come up before).

Switching to sharing shouldn’t list your app in the Marketplace or change who has access to the install URL. But it should stop requiring users to consent to asApp actions.

6

Setting the app to shared seems to have worked. I am able to un-share the app and it should be fine?

7

Should be!

8

Seeing the same problem. If we enable sharing , do we need to provide the install link to ur users to get around this problem while Atlassian fixes this or can we enable sharing, confirm with users they are seeing the forge app in the JSM portal view and then disable sharing? or does each portal customer have to install the app using the link after sharing is enabled?

and if no install is needed, can we disable sharing and then the app will keep on working for our users?

9

Thanks for clarifying @AaronCollier!
@OmarRashid if the app is being used in production by users other than the app developers, distribution should be set to sharing (reference doc on how to do this: https://developer.atlassian.com/platform/forge/distribute-your-apps/#distribute-your-apps)

Once you mark it as Sharing, it should start working on its own.