Confluence guest users, Entra ID sync, and Atlassian Guard licensing

[Brent Lee]

TL;DR We have tier licensing for Atlassian products at 200-300 users. Our Atlassian Guard user count is exceeding this because of the size of our identity provider sync group members. The total licensed users for each product (besides JSM) should be nearly identical (~280 licensed users).

We are using Entra ID to provision users into Atlassian through synced groups, and I am trying to confirm how Confluence guest users affect Atlassian Guard licensing.

My understanding is:

• A Confluence guest does not consume a paid Confluence license.
• A guest does not necessarily need to be provisioned through Entra ID and can be invited directly in Atlassian Administration.
• If a user is removed from the Entra ID group, has no other Atlassian product access, and is no longer provisioned through our identity provider, they should not consume an Atlassian Guard license.
• However, if that user still has Confluence guest access, they may still count as a billable Guard user because they retain access to an Atlassian product.

Can someone confirm whether this understanding is correct?

More specifically:

1. Do Confluence guest users need to be synced or provisioned through Entra ID?
2. Does a Confluence guest count toward Atlassian Guard Standard licensing even though they do not consume a Confluence license?
3. If a user is removed from the Entra provisioning group and has no Jira, Confluence, Bitbucket, Trello, or JSM agent access, should they stop counting toward Guard licensing?
4. If the user remains a Confluence guest, will they continue to count toward Guard licensing?
5. Is placing guests under a non-billable external-user policy the recommended way to prevent Guard charges?

I want to make sure we are separating product licensing, identity-provider provisioning, and Guard billing correctly.

[Kris Klima _K15t_]

Hi @Brent Lee 

Guests do not count towards individual apps' licenses but they do count towards the user count.

As you may recall, you can add up to 5 guests per a paid licensed user but the total amount of users cannot exceed the maximum permissible user count (Confluence = 250K users).

It seems that if you choose to provision them via your identity provider, they will count. But apparently, you can opt them out.

https://community.atlassian.com/forums/Articles/Collaborate-more-securely-by-enforcing-single-sign-on-for/ba-p/2813301

As to whether you need to provision guests via your SAML SSO, this article may help: https://support.atlassian.com/security-and-access-policies/docs/what-is-external-user-security/

There's a similar Community question here: https://community.atlassian.com/forums/Confluence-questions/how-does-Guard-count-the-guest/qaq-p/3063757

I would suggest that you contact Atlassian billing Support to discuss your specific setup - https://www.atlassian.com/company/contact/purchasing-licensing#/

Other than that, there are solutions allow you to let external users, who are within your identity provider, access your Confluence content outside the Atlassian ecosystem (outside Guard and Confluence licensing). In other words, you can enable controlled access to Confluence content to users who are not users or guests, without enabling anonymous access.