Say ‘hi’ to our new user access admin role

[#1]

What's changing?

Many customers have asked for a new role to allow them more flexibility when delegating administrative permissions to manage users. To address this, we're excited to introduce the user access admin role to admin.atlassian.com. It will replace two of our current roles – trusted user and site admin.

The following example shows an organization (Acme), with one site (acme.atlassian.net) and two products: Confluence and Jira Software. The User access admin role has been applied to a user for Confluence only (but it can be applied to any product if you like). A deeper explanation of the user access admin role is below, read on!

This example illustrates the existing and new admin roles for an organization with one site and two products. You can set the user access admin role for all products if you like.

How does this affect me?

All customers across all plans – Free, Standard, Premium, and Enterprise – will be able to use this new role to delegate user management for admins to specific products.

Existing organization admins (org admins) will have the choice to set their current trusted users and site admins to:

• the current org admin role

• the new user access admin role for their existing products

  • additionally, their product access can be chosen for existing products

• no admin role

What do I need to do?

When we move an organization to the new admin experience, we’ll send an email to all the affect Org and Site admins, letting them know what has changed and which users have been moved to the User access admin role.

Before the move, org admins can minimise any impact to their trusted user and site admin users by changing them to org admin or basic user roles earlier. This isn’t necessary to do upfront, but it can help to make your migration more seamless for these users.

Why is Atlassian doing this?

With the latest changes to admin.atlassian.com, we’re in a better position to build more delegated admin roles, address a lot of our customer feedback, as well as help scale administration for our larger customers.

The biggest piece of customer feedback we get around our admin roles, is how trusted user and site admin roles force users to be granted access to product content – and are therefore paid for/billable – even if they may not use those products. With the new user access admin role, these users don’t need to be granted access to the product content – and won’t be counted as a billable user.

What can the user access admin role do?

How do I grant the user access admin role to a user?

There are three ways to add a user access admin.

1. Add the user to a group with the user access admin role

You can add the user access admin role to a group for one or multiple products, then add users into that group. This will also work for groups synced via SCIM.

2. Grant a user the user access admin role

You can add a user access admin role to an existing user, in the same way you would add any product access to them via the user details screen.

3. Use the invite feature

You can invite a user access admin in the same way as inviting any other user.

Note: For those with keen eyes... Bitbucket will not be available as part of this update, we’re working on this as a future release.

When will this happen?

We’re aiming to start rolling out the user admin role around mid-late 2022 and this will continue through to the start of 2023 mid 2023 and this will continue through to the end of 2023 (we've had some delays). About a month before we start to migrate an organization, we’ll send an email to the org admins outlining the migration plan.

Tell us what you think

We'd love to get feedback about these changes. Influence the future of Atlassian Cloud and send us a message via the Give feedback link in admin.atlassian.com!

Update 11-Aug-2023

1. Updated the role name from User Admin to User Access Admin

2. Updated the table of abilities for the User Access Admin

3. Clarified the 'What do I need to do' section

4. Updated the 'What user access admin role can do' section

[Joseph Blasi]

User admin can't remove users if they have access to an app? So really to remove an user you need org admin?

[Yatish Madhav]

@Kieren thanks for this update, Kieren! I think this helps and has great potential ... One question, if this removes the need for site and trusted admins. Is there possibility in future for custom admin roles at all? Looking forward to the new comments on this ... Thank you

[Kieren]

Hi @Joseph Blasi - Apps don't have a separate user access, their access is derived from the product access. So this new admin role will be able to remove users from any product, regardless of app usage.

@Yatish Madhav - No plans right now. But it is something we'll look into, once we have this fully rolled out.

[Yatish Madhav]

OK thanks for that @Kieren  -  I will be sure to look out for that :) As for this, when can we expect this and the other user/groups UI updates to be rolled out?

[Kieren]

@Yatish Madhav - We'll starting rolling out this new role in April late 2022. The other UI updates have been rolling out for a while now, and will continue to do so for a number of months.

If you'd like to know when your specific Site will be updated, you can raise a support ticket with the question, and they'll redirect it to my team.

[Yatish Madhav]

Thanks @Kieren - I have done so. I have been notified that Org admins will be notified a month prior and when it is updated on the account. THat ticket is closed now so the wait begins :)

[Siobhan Flynn]

This is wonderful news, and will really help streamline administration duties! Thanks Atlassian!!

Also love that Trusted User is getting removed, it's always been a bit confusing as that role grants admin privileges (and more) without being called admin. Always been a tough one to wrap my head around.

[ShayanJ]

hi

[Shane Johnson]

Any update on this???

[Kieren]

@Shane Johnson we've had some delays, but should be rolling this out to new customers around May/June 2023 and moving existing customers onto it from June through to the end of 2023.

[Anirudha Prasad Padarha]

I am new to JIRA & enjoying the learning.

[mpetrovich]

Hello,

Any update on the status of this for May/June?  And how do we get at the "front of the line" for the rollout as we have a pressing need for this new functionality.

Thanks,

Mark

[Haddon Fisher]

This sounds like a great step! Some questions:

1. This new role can both manage existing users and invite new ones. If we have "invite users" disabled at the org-level, is it correct that this functionality is also disabled for this role?

2. When you say that these user admins can grant product access "only for their specific products" does this mean if they have a Jira licence for themselves to access Jira, they can also add\remove others from Jira access?

3. Related to 2, I see several things around changing product access that are coming later on....are these going to be disable-able at all or will this role automatically and irrevocably get access to these things?

"Groups" has always been one of those things we couldn't really take advantage of because:

• The best way to handle change management in Jira has been keeping the admin pool as small as possible.
• Jira admins are the only ones who can manage groups.
• Jira admins almost always have better things to do with their time.

I'd love to be able to delegate management of them to non-admins, but I can't have them changing what products people have access to or adding\removing users.

[Tere Pile]

If this gets me out of group management w/still controlling licenses I'm all for it!!!!! 

[Kelley R]

Would I be able to use this to make my automation user a non-billable seat?

[Kieren]

@Haddon Fisher 

1. This new role can both manage existing users and invite new ones. If we have "invite users" disabled at the org-level, is it correct that this functionality is also disabled for this role?

No, the "Invite users" feature is only applicable to regular product users, not users of admin.atlassian.com (i.e. Org Admins or the User Access Admin).

2. When you say that these user admins can grant product access "only for their specific products" does this mean if they have a Jira licence for themselves to access Jira, they can also add\remove others from Jira access?

No, it means that the User Admin can be allowed to grant a license to Jira Software (for example), but no other products. Regardless of if they have a User or Product admin role in that product or any other product. Having a license to use Jira Software and having the User Admin role, are two different (non-related) permissions. You can combine them though, so one user can have both a user role in JSW and a User Admin role for JSW. And this would allow them to both use Jira and invite users to it.

3. Related to 2, I see several things around changing product access that are coming later on....are these going to be disable-able at all or will this role automatically and irrevocably get access to these things?

I'm not sure what things you're referring to sorry. Generally speaking, the User Admin role will only be able to invite/add/remove users to products and add/remove users from groups. Later on, we'll expand it to also manage the 'User Access Settings'.

"Groups" has always been one of those things we couldn't really take advantage of because:

• The best way to handle change management in Jira has been keeping the admin pool as small as possible.
• Jira admins are the only ones who can manage groups.
• Jira admins almost always have better things to do with their time.

I'd love to be able to delegate management of them to non-admins, but I can't have them changing what products people have access to or adding\removing users.

We do have plans for more features to address this issue, i.e. allowing certain users to only add users to specific groups from within your userbase. I'm sure there'll be more info in another blog post later on.

[Daniel Vest]

Will this change/addition of the User Admin be able to manage the Portal Only users (customers) accounts as well? Is it possible for someone to be granted this role or User Admin and still not be admin over on a project (so that they do not tinker and make changes)?

Thanks

[Haddon Fisher]

Hi @Kieren thanks for the answers. I think I'm not quite getting what I need, so let me ask this question in another way:

Is there a way to set this new role up such that users in it can add\remove users from groups but cannot impact licencing in any way (including adding\removing users from licence-granting groups such as the 'jira-users' or 'confluence-users' groups)?

We need a way to allow group management alone, without exposing add\remove licencing.

[Dave Mathijs]

@Kieren What is the current roll-out status of this announcement?

I'm still seeing the current/old roles Basic, Trusted and Site administrator.

[Pavol Sočuvka]

Hi @Kieren , thanks for the update and good luck with the rollout.

Quick question, what about approving domains and creating invitation links? Is user admin any good for that?

[Yatish Madhav]

@Kieren commenting, 10 months later, I can only imagine the delays and technicalities for this - I am assuming this is due to the new user UI and group editting feature as well? Thank you

[Alessandro Di Prima]

Any ETA?

[Yatish Madhav]

@Kieren this was just rolled out to our instance, I will check it out later today ... but support mentioned that it is in beta. Hope there is general availability of it real soon :) Just putting it out there so that the rest of Atlassian folk are aware of that (I hope I am not mistakening anything on this vs the User Access Admin role) Thank you

[Roger Abreu]

We received the update today and it was not very productive. Simple tasks that we used to do with the site admin role are no longer available, such as activating and deactivating users and exporting the base to a CSV. Would it be interesting to have an intermediate role between org admin and user admin, where it is possible to have the same permissions as the old site admin?

[Tomislav Tobijas]

We've also just received an email about role changes for one org that we administer. Even though you can get to the correct admin hub by clicking on Download CSV button, it would be great if mail stated to which org this feature has been rolled out as we administer a lot of cloud instances.