How to Automatically Reassign Jira Cloud License After User Is Removed from Group and Logs In?

Question

Hello,

In our Jira Cloud environment, we manage user licenses by adding/removing users from the product access group (e.g., jira-software-users). If a user is removed from this group (thus losing their license) and later logs in to Jira Cloud, is there a way for the license to be automatically reassigned upon login? Or does the user always need to be manually re-added to the group to regain access?

Additionally, is there any way (via automation, SSO, or URL parameters) to trigger license reassignment when a user tries to access a specific issue URL after their license has been removed?

We are aware that in Jira Data Center, URL parameters could be used to force SSO authentication and license reassignment, but this does not seem to work in Jira Cloud.

Any advice or best practices would be appreciated!

Thank you.

Kieren _SmolSoftware_ · Answer

Hey @Eunji Roh

1. Removing inactive users: There's nothing that Atlassian offers to easily do what you're asking unfortunately.

Your only option is Marketplace apps (we build one called Admin Automations that can remove inactive users and add users to groups) or use the Atlassian APIs to create your own script or app.

2. Added users back in: A few of our customers remove user licenses frequently, and setup their User Access Settings to allow users from their email domain to get access when they visit the product.

If they're concerned that too many random users from their organisation might get access to the product, they create a 'safe users' group and put all the users they'd be comfortable to be given access to the product, into that group. Then they setup an automated rule to remove any users who aren't in the 'safe users' group. There's a use case listed for this on our website if you're interested, you can find it from the Marketplace URL above.

Good luck

-Kieren

Tomislav Tobijas · Answer

Hi @Eunji Roh ,

To start with the last part about SSO—to have enforced SSO in the cloud, you'll need to have Atlassian Guard Standard or Premium. Here are additional instructions on how to configure this: Configure SAML single sign-on with an identity provider

For the first part about automatic licensing, there's no out-of-the-box solution for it. Basically, you'll have to manually add or remove users from groups that are linked to a specific app (ex., product).

In theory, if you have enforced SSO, you could try to like use some kind of integrations from your IdP to Atlassian Admin directory in a way that if user tries to log in to their account, some kind of trigger is sent from IdP to Atlassian to assign them to a group (or it is automatically triggered on IdP side) 🤔 But, I've never actually implemented this nor I can confirm it will work.

There are some apps, such as Flexible User License & Seat Auto Management for Jira, which remove and add licenses based on user activity. We've tested this in a couple of scenarios and it works quite well. These tools are used mostly if you want to be 'flexible' when it comes to licensing and potentially reduce the number of licenses or just avoid manual activation/deactivation of users in some manner.

Again, there's no clean solution to this and it's mostly recommended to handle everything via IdP (which is connected via Guard) and then try to configure everything, including some kind of automations on the IdP side.

Hope this helps.

Cheers,
Tobi