Priority of Authentication policies for external users (that exist in other Orgs)

[Rebekka Heilmann _viadee_]

I understand the concepts of Authentication policies for internal and external users. However, in the following use case, it gets a bit confusing and I couldn't find official info on it:

Our Org - let's call it Acme - has Atlassian Access and set up very strict policies, both for internal and external users.
Our customers Org - Cus - has Atlassian Access and set up less other policies.

We work together closely. Some of Cus are collaborating as "Guests" in our Confluence. I, with my Acme Account, am Org Admin of Cus.

When Cus Guests are logging into our Confluence, they need to authenticate through their IDP and vice versa. So it looks like the Authentication policies of the other Org are triggered.

None of the official docu is mentioning that scenario or that functionality.

---

Now the question:

What if the other Orgs policies don't fulfill our minimum requirement and are less strict than what we set up for External users... What policy is triggered?

[Rebekka Heilmann _viadee_ · Accepted solution]

Sorry - I somehow couldn't find this previous post in my history or anywhere else and created a duplicate post: Enforcing Policies for External users from other A... (atlassian.com)