To delete or not to delete, that is the question

[Jeramy Spring]

I've been an Atlassian admin for years and over the course of those years, my "best practices" have changed or evolved. However there is still one topic that I sway from side-to-side...like a ship rocking in the sea.

My company allows our customers to create Jira issues through e-mail. However, this generates a lot of "fake" users in Jira as our customers usually include everyone on the e-mail. So.....

---

Do you delete internal Jira users who have never logged in, created a ticket, or left a comment or do you deactive them?

---

Some days, I want to delete the user out of the system because I hate seeing tons of users with a line through them. Other days my security side kicks in and says, "Deactivate them because I do not know who might have that e-mail address and I don't want them being recreated."

So what do you do with these types of Jira accounts?

[Nic Brough -Adaptavist-]

The recommendation was always "disable users who leave, if they have any footprint in Jira" because deleting them means destroying your history, which may be needed for audit or compliance.

That still stands, but the important bit is the "footprint" - it's fine to delete a user if they have not touched any of your issues, you won't lose anything.

But, yes, if people are going to do this repeatedly, you are going to find non-users reappearing.  

All you can do in this case is disable them, unless you know they've stopped using the email address that is being associated.