How are users getting added back to JSM after having disabled it for them?

Question

A few weeks ago I turned off JSM access to several Jira users, leaving it active for just our Support team.  Starting a couple days ago, I started getting emails from Atlassian telling me that a user "has joined Jira Service Management".   Sure enough JSM is active for them again and I turn it off only to receive a message the next day that its back on for them.  This has happened for a handful of those Jira users I had originally turned JSM off for but not all of them.  When asked, the Jira users that were mentioned in these emails are not aware of any action on their part that would have triggered the emails on their behalf.

Why is this happening and how can I get it so they stay disabled from JSM?

Dirk Ronsmans · Answer

Since they are internal users I have a feeling they might be added to a group with default access.

Can you look in to how your users are being provisioned? (getting in to your Jira instance). If you have some Activity Directory groups that are being synchronized they might be getting in every day again when the groups sync.

Thomas Leech · Answer

Hi @Dirk Ronsmans  Thanks for your response.

> Are they added as customers or as licenced users (with access to the project internals)?

These are our some of our internal developers and are licensed users of Jira.

In user management I have turned off both JSM Agent & Customer settings.

> Do you have a sync set up with Atlassian Access/Azure AD?

I don't know the answer to this question.

Dan Breyen · Answer

I don't know all the goings on behind the scenes but that would sound reasonable. I believe there's other settings above that to control internal/external access.