Atlassian announced the JSM App Admin role on 21 October, with rollout completing in December 2026. The pitch is least-privilege delegation: app-wide JSM configuration without unrelated Jira product settings. The pitch is accurate. The problem is what admins do with it next, which is usually “take Jira Administrator away from the service owners”. The support page Atlassian linked from the announcement says that is one layer too early.
What the comparison table says
The page “What are app roles in Jira Service Management” carries a role comparison table. For the new role, read in full on 2 November 2026, it is Yes on every app-level row: app settings and configuration, usage and consumption settings, app user management, app audit logs, compliance settings, email settings, authentication settings, customer organizations settings and knowledge base settings. It is also Yes on space user management.
It is No on every space-level row: space settings and configuration, queue settings, SLA settings, automation settings, request type settings and operations settings. Those are Yes for User (agent), with the note “Requires space administrators role”. Viewing queues, resolving tickets and commenting are No for the App admin too.
The role is unlicensed and non-billable, and organisation admins assign it per JSM app. Ash Young confirmed on the announcement thread on 27 October that administering SLAs and queues without a User (agent) licence is planned, and that “for now this still remains with the User (agent) role”.
The three layers
Put the table next to how a company-managed service space is actually built and you get three layers, not one.
Layer 1, the app. The new role. Authentication, email channels, customer organizations, knowledge base settings, usage, audit, compliance, who is a user of the app. This is the layer that used to need a Jira Administrator for no better reason than that the settings lived under Jira settings.
Layer 2, the space. Queues, SLAs, request types, space automation, operations settings. Still User (agent) plus the Administrators space role. A JSM App Admin who is not also a licensed agent cannot open a queue, let alone edit the SLA behind it.
Layer 3, the schemes. Request types sit on issue types. The workflows, screens, custom fields, field configurations, permission schemes and notification schemes behind a company-managed service space are Jira administration, and nothing on the role page or in the announcement moves them. Ash Young’s own hierarchy on the thread puts Jira Administrator above JSM App Admin: Org admin, Site admin, Jira Administrator, JSM App Admin, Space admin.
On the organisations I administer, layer 3 is where service owners still come to the central Jira admins: a workflow change, a new custom field, a screen tweak for a request type. The new role changes none of those conversations. It changes the layer 1 ones, which were real but fewer.
What this means for a “JSM only” service owner
Three assignments today, not one:
- JSM App Admin for the app layer.
- User (agent) plus space Administrators for the queues, SLAs, request types and automation they own.
- A Jira Administrator on call for schemes and fields, which is the same arrangement as before.
If you remove Jira Administrators App Admin from a service owner on the strength of the announcement alone, the first thing that breaks is not an app setting. It is the request type whose issue type needs a new field.
Before you redesign the admin groups
A short checklist, in the order that saves rework:
- Export who holds Jira Administrator today and why. Tag each person: app-layer reasons (authentication, email, customer organizations), space-layer reasons (SLAs, queues), scheme-layer reasons (fields, workflows). Only the first group moves cleanly to the new role.
- Confirm the role is on your site. The rollout runs through December 2026. Until the role appears under the JSM app in Atlassian Administration, there is nothing to assign; plan, do not act.
- Keep both roles on service owners until SLAs and queues move. Atlassian has said that is coming; it has not said when. Removing Jira Administrator before then forces every SLA change back through the central team.
- Decide what the App admin audit log covers for you. The table says app audit logs; whether that satisfies your compliance reviewer where the site audit log did is a question for the reviewer, not the role page.
- Write down the scheme-layer escalation path. It did not go away. Make it visible so service owners stop expecting the new role to cover it.
- Watch for Customer Service Management. Ash Young said CSM will get its own App Admin later and that the two apps currently share some settings; if you run both, hold the redesign until the isolation lands.
What I would still like to know
The announcement asked which JSM tasks still require Jira Administrator access. My list is above: fields, workflows, screens, schemes. If yours is different, say so in the comments; I will bring the answers back to Atlassian’s thread with credit. I have also opened the same question in the JSM User Group for people who prefer to answer there.
Verified 2 November 2026 against What are app roles in Jira Service Management, What are space roles in Jira Service Management and Introducing the JSM App Admin Role including Ash Young’s replies of 22 and 27 October. Cloud only.
