How do I disable/remove license from admin email address being imported from Entra?

[Dee from Texas]

We have reached our license limit.  We discovered there are people who have multiple accounts due to having multiple company email address (ie Admin accounts).  We pull our users from entra.  I need help disabling or removing the licenses from these accounts.  

[Dirk Ronsmans]

@Dee from Texas do you need the accounts to be on the platform?

If not, I'd just change the scope of your Entra ID app registration to not include these accounts.

[Dee from Texas]

Does this allow us create a script or agent that will give out licenses as needed.  So when entra syncs confluence looks to see if the user has been active in the last 90 days and removes their license if they haven't.  Then giving licenses automatically when they put in a ticket request.  

[Tomislav Tobijas]

The script can probably work. Rovo, on the other hand, doesn't have the skills to access Atlassian Administration, but it will be cool when they expand the 'scope' so agents can access that area.

As for scripts (or Forge app), you could do:

• Use the Atlassian Admin APIs to fetch user lists and activity data

• Calculates which users haven't been active in the last 60 or 90 days

• When it finds those users, the script/app sends the user's data to IdP and then you handle it from there > activation/deactivation or licensing/group membership.

The same would apply to giving licenses automatically.

[Tomislav Tobijas]

Hey @Dee from Texas ,

In this case, everything is managed on the Entra side, although it might depend on how the provisioning is set up/configured. As Dirk said, you can configure the scope of provisioned users/groups and sort them like that.

On the other hand, you can also navigate to admin.atlassian.com > Directory > Users and from there just suspend access to a particular user.

I'd still recommend resolving this on Entra side, but this is an alternative approach.

Note: Atlassian currently doesn't support merging two or more accounts > feature request: ID-240: Ability to merge Atlassian accounts to a single account with secondary emails 

Cheers,
Tobi