How can I remove a user from group "system-administrators"

The system-administrators group (and its variations like jira-system-administrators) is a protected system group. In Jira Cloud, certain groups are managed by the underlying Atlassian platform to ensure system stability and security.

1. Why you are seeing "Group not modifiable"

The error message "Group not modifiable" typically occurs because the group is considered a system-managed group. These groups often have restricted membership rules to prevent accidental lockout or unauthorized elevation of privileges.

In many cases, if a group is not visible in the standard Directory > Groups UI at admin.atlassian.com, it is because it is a legacy or internal system group that is not intended for manual modification via the standard Jira REST API (/rest/api/3/group/user).

2. How to Remove the User

Since the standard Jira API is returning a "not modifiable" error, you should try the Atlassian Administration (Organization) API instead. This API operates at a higher level than the Jira-specific API and is often required for managing protected groups.

The correct endpoint to try is:
DELETE /admin/v1/orgs/{orgId}/directory/groups/{groupId}/memberships/{accountId}

Steps to perform this:

1. Get your Org ID: You can find this in the URL when you are at admin.atlassian.com.

2. Use an Organization API Key: Note that this requires an Organization API Key (Bearer token), not a standard Jira API Token.

3. Execute the call:

3. Important Considerations

• Managed Accounts: If the user is a "Managed User" (synced via SCIM/Azure AD/Okta), you may need to remove them from the group in your Identity Provider rather than in Jira.

• Site Admin vs. Org Admin: Ensure you are performing these actions with Organization Admin privileges. Site-level administrators often lack the permissions to modify system-protected groups.

• Hidden Groups: As a best practice, we recommend avoiding adding users to "hidden" groups found via the API, as these groups may be part of legacy configurations or internal Atlassian service accounts that can cause unexpected behavior if modified.

Verified Documentation

• The Organizations REST API REST API

• Managing global permissions | Administering Jira applications Data Center 11.3 | Atlassian Documentation (Note: While this is a Server/DC doc, it explains the protected nature of the System Admin permission).

I hope this helps you resolve the issue with the stuck user membership!

Thanks @Alexandre Pezzini  and @James Gamble  for your help and detailed instructions

I tested this API:
DELETE
`/admin/v1/orgs/{orgId}/directory/groups/{groupId}/memberships/{accountId}`

I also tried this one:
DELETE `/v2/orgs/{orgId}/directories/{directoryId}/groups/{groupId}/memberships/{accountId}`
(Ref: https://developer.atlassian.com/cloud/admin/organization/rest/api-group-groups/#api-v2-orgs-orgid-directories-directoryid-groups-groupid-memberships-accountid-delete)

I tested with other groups and they can be deleted. However, for the “system-administrators” group I got this error:

{
"errors": [
{
"id": "722d8b0f-e6de-47d2-b3a1-325d2dbc6fc9",
"code": "ADMIN-UAM-400-11",
"status": "400",
"title": "Group cannot be modified",
"detail": "These groups are not modifiable"
}
]
}

I believe this is due to the permissions concept you mentioned from Atlassian.

My target is to find an API I can use in a Forge app to search groups and assign a specific user to a group. But all available Jira group search APIs return the “system-administrators” group, which is not safe to assign.

Is there any other API or best practice that can help us fetch only assignable groups for a specific user? I would sincerely appreciate any guidance. Thank you very much.