Atlassian Guard and Atlassian

Question

Hi everyone,

I am a Jira administrator in my organisation. I have been removing Jira Software access from users who have been inactive for the last 90 days by removing their User role for the Jira app.

I successfully removed access for some users, but for others, I received a pop-up preventing me from removing the role. Please refer to the attached screenshot, Role_Re. Could someone explain why this happens and how to resolve it?

I would also like to understand the relationship between Jira Software licences and Atlassian Guard billable users. Over yesterday and today, I believe I removed approximately 72 Jira Software licences, and I noticed that the Atlassian Guard user count decreased by 10.

Could someone please clarify:

* How does removing Jira Software access affect the Atlassian Guard billable user count?
* Why might the Guard count decrease by only 10 after removing approximately 72 Jira Software licences?
* What steps should I take to further reduce the Atlassian Guard billable user count?

Thank you for your guidance.

Role_Re.png

Jonas Nilsson | Unitlane · Answer

Hi Priyadarshini, Arek has the pop-up right. Your screenshot says the Jira User role comes from a group that also grants an admin role, so for those people you take them out of that group instead of clearing the role on their profile. Worth a look at who else is in there too, since someone inactive for 90 days rarely needs admin rights.

On the numbers: Guard Standard counts each person once, however many apps they can reach, and they stay counted while they have access to any of Jira, Confluence, Bitbucket, Trello or Jira Service Management, Free plans included. People who only use the JSM help center don't count. So removing Jira only lowers the Guard count when Jira was the last app that person had. That would explain your result: about 10 of the 72 had nothing else left, and the rest most likely still have another app.

To reduce it further, use the export Arek linked. The CSV shows each person's last active date and whether they're billable, so you can sort for billable people who've been quiet for a long time and check what still gives them access. Atlassian lists three ways from there: remove that remaining app access, deactivate accounts you no longer need, or move people to a non-billable authentication policy. That last one means no SSO or two-step enforcement for them, so keep it for accounts that have to stay.

Since you're working through this by hand, full disclosure: I make Seatwise, a Jira app that shows which groups give each person their Jira seat and takes them out of those groups with an Undo. It only covers Jira, so you'd still use the export for Guard.

https://marketplace.atlassian.com/apps/417237412/seatwise-inactive-users-licenses-leavers-for-jira

Arkadiusz Wroblewski · Answer

Hello @Priyadarshini R

This error means Jira access is coming from a group that also grants admin permissions. You can check the group memberships and, if they’re managed through SCIM, make any needed changes in your identity provider.

Regarding Jira licenses, removing doesn't automatically lower your Guard bill, because users may still be billable through other Atlassian products. To see who’s still billable, go to Atlassian Administration → Directory → Managed accounts → Export members. The CSV will identify those users.

https://support.atlassian.com/organization-administration/docs/export-managed-accounts/

Cheers,

Arek🤠🧙‍♂️