Compliance Issue: Inability to Manage or Delete External Jira Instances Created by Departed User

[Pierangelo Repetti]

I am stuck in a deadlock, I'd like to know if any other Site/Org Admin has had this problem and how they solved it.

Briefly

• Atlassian Organization with managed users
• Jira Standard plan (no Guard, no Premium, no Enterprise)
• As soon as someone leaves our company, I have to deactivate their Atlassian user, as per certification and regulation compliance (ISO 27001, NIS2 etc)
• Deactivate managed user under Atlassian Admin console stops with error: "User is last billing admin of a transaction account that has one or more active entitlements"
• Turns out this user created their own Jira site in the form company name-team-uid.atlassian.net and crowned themselves "site admin", thus blocking deactivation
• Standard plan offers no way to control creation/modification/billing of such sites
• Raise ticket to Support
• Support spends 3-4 replies explaining how to handle this in Enterprise plans
• Some more emails asking me to buy Guard
• Eventually understands that we're on Standard plan
• Asks for an email from the user confirming that site can be canceled
• Having the user left our company and lost access to mailbox, there's no way to have such email written
• Support suggests the IT Admin logs into the mailbox and writes such email impersonating the user - REALLY ? That's a felony, at least in Italy
• Stuck there
• Sent email to Atlassian Compliance Officer for advice, never got an answer.

So did any of you find this problem and how did you solve it ?

[Evgenii]

Hi, @Pierangelo Repetti 

I met the same situation. One of our org admins occasionally created new instance. 
I wrote request to Atlassian Support, described situation, and support specialist helped with removing of this instance.
He asked for approval and started procedure of deletion.

Hope, they'll help you too.

Best regards,
Evgenii

[Pierangelo Repetti]

Hi and thanks for your reply. If I'm not mistaken you describe a slightly different case. They asked for approval to a person still working for your company.

In our case where the owners of the new instances are already out.

[Evgenii]

Well, not exactly. The case is lamost like yours.
I'm admin in company, and I approved deletion. They haven't asked another person, who made it. Added information from ticket without sensitive data. My approval was enough for them, as you can see.

[Pierangelo Repetti]

Quite interesting, thank you.

Here follows my experience instead

It seems they have different rules for similar requests.

[Evgenii]

Yes, that's odd. 
Maybe try to restore account of this user, if it's managed, and make actions under his account?

[Pierangelo Repetti]

Actually there is nothing to restore, because I'm not able to deactivate it in the first place.

I can't make actions in the account. You mean reset its password, set a new one and then try to connect with that account to the external instance ? That would imply getting into the user's mailbox and I'm afraid that's not allowed but for some serious reasons that do not include deactivating an Atlassian user. But then why ? Why waste such a long time poking around with accounts and mailboxes just to deactivate what should be a user managed by my organization ?

[Evgenii]

Well, I'm sure there is person is organization, that is allowed to make it. Some cyber security specialist, for example, or another person with enough privileges.
He can login to account, and answer in ticket, that he approves deletion.

About reasons - it's company policy, as I understand. Only owner can approve.
Sorry to say, but it's Atlassian Community, we can't influence on their decisions.