What caused a large amount of users to be deleted from our Jira instance?

Question

Hi all. I was advised that some Jira users were now appearing as "(Inactive)" on our tickets. When I looked up their profiles, they no longer exist in our Jira instance. I checked the audit logs and it does not mention who or what made the changes, but the only clue I see is that "Parent Object" involved was an "IDP Directory". 
Is there any way of finding out more information/history regarding these actions? These are our customers who need to be able to raise and respond to tickets with us. Any clues or suggestions would be greatly appreciated. 
Thanks!
Mark

Trudy P Claspill · Answer

Adding to this...

You Jira product exist on a Site that is within an Atlassian Organization Cloud. Your company has people that are Administrators of that Organization, and they would have set up the integration with an IDP Provider.

Management of users that can access the site happens at the Organization level. If there is more information to be had, it would be in the audit logs at the Organization level, and accessible only to Organization Admins.

Mark Kurdyla · Answer

Hey Paul.
Thanks for your quick reply. That definitely does make sense. The Active Directory is another avenue I am investigating. I have a feeling that is where I'll find the culprit. I have raised a ticket internally to try to get to the bottom of this.

However, I guess my question for this post is to find out if there was anything beyond the audit log that could shed some clues. The audit log does not seem to indicate the user or integrated system that was responsible for actioning each line item. I would hope there would be a record somewhere on the Jira side. 
But I'm glad you noticed the same about the IDP - I'm hoping my internal teams will be able to uncover the mystery (and hopefully fix it!).

Thanks again. I'll try to update this post with any further insight I receive, for the record. 
Regards,
Mark

Paul Wiggers · Answer

Hello @Mark Kurdyla

Sorry this happened to you, especially since you can't see what happened.

I am just going on a hunch here, feel free to ignore me if this doesn't make sense :)

You mentioned the involvement of an IDP Directory, which implies that you are managing your customers through an integration with, for example, Active Directory.

Could it be that someone deleted the users in the directory, causing them to be deleted as a JSM customer?