Which action exactly will be registered as "remove user as org admin" in the audit log?

[Radostina Kavrakova]

Hey all, 

I'm exploring how to set up email notifications to org admins when a user is added as an org admin - advice on this will be appreciated.

And I found out something strange to me:  

I removed a user from group org-admins in my organization and expected to find an audit log entry for Activity "Removed user as an organization admin". But there's no such entry. 

Rather, there's another one - of Action user_removed_from_group.

(btw in the filter for log entries, it's called Activity, in the right-hand side panel - Action - why?) 

So I wonder what action exactly is registered as "Removed user as an organization admin" in the audit log? 

Thank you all!  

[Utkarsh Agarwal · Accepted solution]

Hi  

When you remove an org admin in Atlassian Cloud, the audit log entry typically appears as:

Removed user from group org-admins

This is because org admin privileges are granted through membership in the org-admins group. So, whether you remove a user from this group directly or via the dedicated Administrators section in the older organization settings navigation, the underlying audit log action reflects a group removal, not a more explicit phrase like “Removed user as org admin.”

In the legacy UI, org admins were managed under:

admin.atlassian.com → [your org] → Settings → Administrators

In that view, adding or removing org admins would still result in the same audit log entries tied to org-admins group changes.

With the current navigation and unified admin experience, org admins are now managed via the Directory → Groups → org-admins, but the audit logs haven’t changed in structure—they continue to reflect group-based role management.

Hope that clarifies it!

Regards
Utkarsh