Impact of removing managed accounts (claimed via domain) on access to other Jira sites

[nagata shumpei]

I have a question regarding Atlassian Guard and managed accounts.

Here is our current situation:

• We have verified our domain and enabled automatic account claiming.
• As a result, users with the same domain (including those using completely different Jira sites) have been added as managed accounts in our organization.
• Some of these users appear with the status "Not invited" in the user directory.

My question is:

If we remove these users from our organization (via the Administration → Users page),

Will this action affect their access to other Jira sites (outside of our organization)?

Additional clarification:

• These users may actively use Jira in other organizations/sites.
• We only want to remove them from our organization, not disrupt their existing usage elsewhere.

If anyone has experience with this scenario or can point to official documentation, I would really appreciate your help.

Thanks in advance!

[Arkadiusz Wroblewski]

Hello @nagata shumpei 

Just to clarify, pulling the domain claim won't automatically cut off anyone's Jira or Confluence access. What actually happens is a shift in account ownership. Once that domain is no longer verified, those users stop being "managed accounts" in your organization, meaning they are no longer subject to your specific authentication or security policies.

While you stop managing the accounts, their actual ability to log into your site stays the same. If the goal is to stop them from using your tools, you still have to go into the admin settings to manually remove or suspend their access. Atlassian treats "access" and "domain ownership" as two different things, so removing one doesn't kill the other.

If you need a firm cutoff, your best bet is to deactivate the accounts while they’re still managed. Just be careful not to treat a domain unclaim as a security kill-switch; it’s really just a change in who owns the account record, not a guaranteed way to revoke product access.

[nagata shumpei]

Hello @Arkadiusz Wroblewski 

Thanks for your explanation.

Just to clarify further, my question is specifically about "removing users from the organization", not unclaiming the domain.

If I remove a user (who is currently a managed account) from my organization via the admin user directory:

→ Will that have any impact on their access to other Jira sites or organizations?

My understanding is that removal only affects access within my organization, but I’d like to confirm this behavior.

[Arkadiusz Wroblewski]

@nagata shumpei 

You're exactly right. Removing a user from your organization only cuts off their access to your specific sites. It won’t affect their ability to log into other Jira instances or organizations where that same Atlassian account is still active.

Basically, removing them from the org is local to your environment, while deactivating the managed account shuts it down everywhere.

[nagata shumpei]

Thanks for your clarification.

I’d like to confirm one more specific scenario to ensure I fully understand.

In our organization, we currently have around 100 managed accounts.
However, about 30 of these users were unintentionally added as managed accounts due to domain verification and automatic claiming. These users actually belong to other Jira sites (different organizations) and are not intended to be managed by us.

If we remove these users from our organization via the user management page ("Remove user"):

→ Will this have any impact on their access to other Jira sites or organizations where they are actively using Jira?

For context:
- These users are not invited to our site
- We only intend to remove them from our organization
- We want to make sure their existing access elsewhere remains unaffected

Could you please confirm this behavior?

Thanks again for your help.

[Arkadiusz Wroblewski]

@nagata shumpei 

You’re spot on. Removing those users from your organization only cuts their ties to your specific sites and data. It doesn't impact their access to any other Jira instances or organizations where they might be using that same Atlassian account.

This works because Atlassian treats "access" and "identity" as two separate layers. When you remove someone from your organization, you're essentially just taking back their key to your front door; it doesn't stop them from using that same key for other buildings they already have permission to enter.

Even if these accounts were accidentally claimed by your domain, unclaiming them simply makes them "unmanaged" again. They keep their account and whatever external access they already had. The only thing you really want to avoid is deactivating the account. Deactivation is a global kill-switch that locks the account entirely, which would prevent them from getting into any Atlassian apps anywhere.

So, as long as you just remove them from your organization without hitting the deactivation button, their access to other sites will stay exactly as it is.

If you want, make small Test with 1 User.