How Are You Managing License Optimization and User Lifecycle in Atlassian Cloud?

[Suraj Aderogba]

Hey everyone,

As organizations scale their Atlassian Cloud footprint across Jira Software, JSM, and Confluence, one of the biggest ongoing challenges is managing user lifecycle and optimising license usage especially when you’re dealing with hundreds (or thousands) of users and multiple instances.

As a solution architect and Atlassian solution expert, i’ve been focusing on:

• Automating inactive user detection and license cleanup (using ScriptRunner and automation rules)

• Streamlining JSM agent provisioning and deprovisioning via Azure AD and/or Okta groups

• Aligning multiple instances under one Enterprise billing and identity management structure

It’s been quite a learning curve, but also an opportunity to balance governance with flexibility.

I’m curious:
👉 How are other admins and solution teams approaching license optimisation and access lifecycle management in your Atlassian environments?
👉 Are you automating cleanup, or managing manually through Access/Insight/third-party tools?
👉 Any lessons learned or gotchas when consolidating under Enterprise billing?

Would love to hear your insights and happy to share what’s worked (and what hasn’t) on our end.

Cheers,
Suraj Aderogba

[Waheed Olanipekun]

Great post, Suraj: this really resonates!

We’ve been going through something similar in our environment, especially around license management and user access cleanup. Once you start consolidating multiple cloud instances, it becomes clear how quickly inactive users and overlapping roles can creep in.

A few things that have worked well for us:

Automating user deactivation through group-based rules tied to SSO.

Running a monthly license review dashboard across Jira, Confluence, and JSM to track inactive users.

Assigning a “license steward” in each department who validates their team’s usage before renewal time it’s made a big difference.

I completely agree that clear governance and communication are key before migrating anything. Otherwise, you end up managing exceptions forever.

Curious: have you tried combining ScriptRunner reports with any BI tools or dashboards for deeper license insights? I’ve been experimenting with a few approaches and would love to compare notes.

[Suraj Aderogba]

@Waheed OlanipekunThanks a lot for sharing this, really appreciate your thoughtful input!

You made a great point about assigning a “license steward” in each department. That’s something I haven’t implemented yet, but it sounds like an effective way to keep accountability close to the teams.

We’ve also been using ScriptRunner for reporting, though mostly for user activity and project cleanup. I haven’t integrated it with any BI tools yet, but that’s definitely an interesting idea. Which setup are you using for your dashboards — Power BI, Atlassian Analytics, or something else?

Would love to see an example of how you’re pulling that data together if you’re open to sharing. Always good to learn what’s working for others in the same space.

[David Cowley]

Currently we have no solutions, but understand the problem. It's disappointing that there aren't more native tools to support dealing with inactive users. Look forward to reading responses from people who are having some success.

[Suraj Aderogba]

Hey @David Cowley, Yeah, I completely understand where you’re coming from. Managing inactive users can quickly turn into a manual, time-consuming process, especially without a native solution that handles it intelligently across Jira, Confluence, and other Atlassian products.

We’ve been exploring a few approaches, like combining Atlassian Access audit logs, automation, and reporting tools to flag inactivity, but it’s still far from seamless. It’d be great to see Atlassian introduce something built-in for this.

I’ll keep an eye on what others share here too, always good to learn from how different teams are handling it.

Suraj

[David Cowley]

Back in our days on Server we had a cheap and simple add-on to aid with some administrative features and one of the things that it did was allow us to set expiry dates on accounts. These were local Atlassian accounts with SSO authentication enabled through SAML/ADFS, but the accounts auto-expired at an arbitrary date selected at account creation. This was great for short term projects and accounts for contractors.

Having something around like that for license expiry would be amazing.

It would also be great to have automated notifications to users:

we see you haven't accessed URL in 60 days, do you still require access, if not please click here to release the license for use by someone else within the organization. Note: all licenses carry a cost paid by the organization, please help us be fiscally responsible by releasing licenses you no longer need.

Ideally with a configurable time period, and follow ups, if the user continues to not login. With eventual automatic license recovery.

That's what I'm going to ask Santa to get me for Christmas this year I think...

[Francine Fisher]

Hi Suraj! Thanks for sharing this, it's a super hot topic, especially now with DC EOL. We had loads of conversations about this with both Data Center and also Cloud customers, from enterprise to SMB, during Team ’25 in Barcelona a couple of weeks ago.

Many customers are seeing the same challenges around lifecycle management, license optimization, and governance across multiple instances as they wish to automate the suspension of inactive users, preventing unnecessary tier upgrades and keeping billing cycles optimized.

Great to see more admins and teams sharing their experiences on this. It’s such an important conversation for anyone scaling their Atlassian environment.

[John Funk]

Hi @Suraj Aderogba  - If you are a vendor from the Atlassian Marketplace, you are required to identify yourself as such and have a company name lozenge in your username. Please let me know if you need another copy of the guidelines. 

[Suraj Aderogba]

@John Funk Is this your comment for me or @Francine Fisher ? I'm not a vendor or promoting any Marketplace solution in my article.

[Matt Doar _Adaptavist_]

But https://www.linkedin.com/company/igniteinnovations1/?originalSubdomain=uk says your company Ignite Innovations Limited is an Atlassian Partner. Or is that not your company?

[Suraj Aderogba]

Hi @Matt Doar _Adaptavist_  What exactly is your point please? Can you educate me please. As a member of an Atlassian solution partner's company, Are my expected to add my company to my name?

Can you show me the guidelines for this please?

Regards,

Suraj

[John Funk]

Hi Suraj, 

Here are the guidelines: https://community.atlassian.com/forums/App-Central-articles/Atlassian-Partners-Rules-of-Engagement/ba-p/2899328

[Suraj Aderogba]

Hi @John Funk Thank you for sharing the Partners rule of engagement. This has been actioned relating to profile setup.

I have responded to you earlier comment/question that i'm not a marketplace vendor nor is my post recommending any solutions? 

[John Funk]

Thank you for the clarification and that was my mistake for the assumption of being a Marketplace Vendor and not a Solutions Partner. The guidelines still apply so thanks also for editing the original post to remove the references. 

[Francine Fisher]

@John Funk @Suraj Aderogba - please accept my apologies for the oversight. I have edited my comment, hopefully appropriately. Please let me know if I can make any additional amendments.

Thank you both for the information, I will ensure compliance moving forward. I love and value this community very much! 

[Goran Dermeta]

Now that we have all sorted out with profiles and signatures, do we have any other useful insight on licence managemnt, which doesn't include buying add-ons or going through user lists manually once a month, to see who hasn't logged-in in the past month? :)

[John Funk]

Sure - just pay each month for the active users you have. When users leave, but sure to immediately disable them, regardless of what day in the month it is. 

[Goran Dermeta]

When you are in a corporation, you usually don't know somebody left, the only sure way to know that is when IT disables their AD account.

If you are rich enough and have Guard, you get those users automatically disabled based on the group change.