Issues with UPN migration, unclaimed accounts, and new shadow accounts still being created

[Deetchiga Soundherraj]

We recently updated our managed accounts in Atlassian to use UPN (User Principal Name), and changed Azure AD so that it only returns the UPN as the unique identifier. Since doing this, we’ve run into some issues:

Some users can’t log in because when we try to update their email to UPN in Managed Accounts, Atlassian says the identifier is “already in use.”

We can see these duplicates in the unclaimed accounts export (under Available to claim). For example, 123@soton.ac.uk
exists both as a managed account (updated to UPN) and as an unclaimed account.

There are thousands of unclaimed accounts in our org (over 4,000), some created as recently as 2025. This surprised us because we assumed that once the domain was verified, new accounts would be automatically claimed.

Our concern is that if we start claiming accounts from “Available to claim,” some users will effectively end up with two accounts (a managed account and their old unclaimed account), which could cause confusion.

Question:
Is claiming accounts from the “Available to claim” pool and then updating the managed account email to UPN the best way to fix the current login conflicts?

[Marc - Devoteam]

HI @Deetchiga Soundherraj 

Welcome to the community.

I think this is an issue in Atlassian Admin, based on it seems that there are duplicate accounts.

I think you need to remove these users from the AD, so that they are not seen aas managed accounts, then add teem again.

But sometimes this even won't help.

Best is to reach out to Atlassian Support

Have them check the backend and the logs, to see what the exact issue is.