Cloud admins, we're saving you time on user management

[#1]

On February 15, 2024, we will begin transitioning current cloud customers to a new, enhanced user management experience within admin.atlassian.com . This transition will occur for single-site organizations and will continue onto multi-site migrations later this year. This effort is a continuation of the work we rolled out to new cloud customers, outlined in our previous update.

This change will uplift user management experience from the site level up to the organization level and provide admins with a single user directory view at the organization level. This change will also impact user and admin roles, as outlined below.

Why we’re making this change

We’ve heard feedback from admins who find managing multiple site-level directories within an organization unnecessarily complex and error-prone. This new experience will help admins save time, provide a more intuitive interface for the frequent task of managing user access, and enable more flexibility to delegate user management tasks to others.

An explanation of the changes beginning on February 15, 2024

Changes to user roles:

• Basic users: basic users can access specified products and apps, they have no additional permissions.

• Trusted users: today, trusted users can access, configure, and add products. They can also invite new users.

We will be discontinuing the trusted user role during the migration to the new user management experience. All current trusted users will automatically be granted the product admin role for the product(s) they already had permissions for. As a reminder, product admins can manage administration settings for a specific product. They don’t have access to Atlassian Administration.

We encourage you to review your trusted users before February 15, 2024 and deem if product admin permissions are appropriate.

Changes to admin roles:

1. Organization admins: an organization admin is the highest level of admin and can complete any administrative task in Atlassian Administration. The new user management experience introduces changes to site and user access admin roles that org admins can utilize for more optionality and delegation. Org admins should review these roles and deem what is most appropriate for their organization.

2. Site admins: site admins are able to manage billing, add products, and manage apps for a given set of sites. Site admins can't manage product access for the sites they administer. To allow them to manage product access in order to ensure a smooth migration process, we will be automatically assigning all current site admins to also be user access admins for all products under the sites they administer.

3. User access admin: this is a new role only available once you are migrated to the new experience management experience. User access admins have limited access to Atlassian Administration and are able to manage user access to the products they administer. They do not have billing permissions or other permissions of site admins.

Summary of changes:

Role	Permissions	Changes after migrations beginning February 15, 2024
Basic user	Can access specified products and apps. No additional permissions.	No change.
Trusted user	Can access, configure, and add products. Can invite users.	This role will be discontinued. For the migration, all trusted users will be assigned product admin roles for the relevant products they are assigned to.
Organization admin	An organization admin is the highest level of admin and can complete any administrative task in Atlassian Administration. They are the only admins with access to the organization’s settings, including security settings, and are responsible for managing users and groups within their organization.	No change. We encourage org admins to review changes to the other user and admin roles to assess what is most appropriate for their unique organizations.
Site admin	A site admins can manage billing, add products, and manage apps for a given set of sites. Site admins can't manage product access for the sites they administer.	For the migration, all site admins will be dual permissioned and will be assigned the new user access admin roles so they can manage both product access and all site admin tasks.
User access admin	User access admins have limited access to Atlassian Administration and are able to manage user access to the products they administer. They do not have billing permissions or other permissions of site admins.	This is a new role only available once you are migrated to the new experience management experience.
Product admin	A product admin can manage administration settings within a specific product. They don’t have access to Atlassian Administration.	No change, but as stated above, during the migration discontinued trusted users will be given product admin permissions.

Below you’ll find visuals of what is changing admin.atlassian.com.
Once the new user management experience is in effect for your organization. Each screenshot shows a before and after view of Atlassian Administration.

New user lists will display all users across all the Atlassian products connected to your organization. Compared with the previous design, we've summarized information about users, made it easier to use filters, and simplified the user status.

The new details page for each user will provide richer information about their account. We've made it easier to identify users and clearly see which products they have access to across all the products.

We’ve simplified the invitation page and centralized role assignments for users. The new design for the group list page will provide more information on each group, such as a members count and a list of products the groups grants access to.

The group details page will show more information on which products the group grants access to, as well as the product access roles assigned to users. Admins can also perform more actions here, such as adding and removing product access for the group and updating group members.

We’ve simplified the product access view and aligned it to the group pages! There is now a list of products, and the ability to add new products if required. On the new product details page, admins will see which groups are used within the product.

What’s next?

There is no required action needed for customers as these changes will take effect automatically for current single-site cloud organizations. However, we encourage organization admins to review user and admin role assignments ahead of this change to deem what is most appropriate. We look forward to continuing this work with multi-site user management changes later this year.

Best, the Admin Experience Team

[Andrea Robbins]

Hello! Very exciting change!

I thought the site admin role was also going away with this change, and instead they would either need to be org admins to manage site settings or user access admins for user management only?

[Andrea Robbins]

While studying for the ACP-520, another difference I found was how the default/non-default groups worked. In the old experience, if you removed user product access, the user was removed from the default access groups, but in the new experience they are removed from default AND non-default groups that provided product access with the User role.

Something for admins to keep in mind :D 

[Tere Pile]

Will the export of users 'columns/order' change? It's currently part of a security review process, just need to figure out what will have to be redone.  Best option would be to allow some level of configuration of column order (wishful thinking)

[Administrator]

Hello, just wondering where the "login as user" option is located on the new look user details page?

Thank you.

[Kirsten_Rhodes]

Hi!  The previous community post about the upcoming changes for this feature were tagged as Atlassian Access.  This post is tagged as Enterprise.  

Can you please clarify the scope of this feature and if different subscription tiers will not be eligible for this?

Additionally, the pervious post specifies that Bitbucket and Trello are not in scope for the first phase.  Can you tell us if this beautiful view of the new User Lists showing what I believe is the User Management and Directory combined has ALL managed accounts for ALL products included?

Thank you!

[Vikki Ulmer]

Hi @Andrea Robbins - thank you for the question! As a part of this migration, we are re-instating the site admin role. This will give org admins more flexibility for delegating tasks and granting permissions.

Also regarding your second comment, the behavior to remove a user from both default and non-default groups is consistent across both the old and the new experience, but if you continue to experience an issue with this, feel free to reach out to our technical support team.

[Vikki Ulmer]

Hi @Tere Pile - thank you for your question! Export users functionality remains, it is now in the Directory view with the same information as pre-migration.

[Vikki Ulmer]

@Administratorthank you for your question! 

1. Go to any users profile
2. Under the section “Product access” there is a table that lists all the product access roles a user holds
3. For the product you wish to impersonate the user as, find the more menu (3 dots icon) and open it
4. The ‘login as user’ option is in the menu

Please see screenshot below.

[Vikki Ulmer]

@Kirsten_Rhodes 

Great question. The new experience will be available to all Cloud plans, and is not only relevant to Atlassian Access or our Enterprise plan. We cross-posted this in the Access group as well, to follow up to the previous community post.

The reason this update was posted in Enterprise was because we believe this new experience will solve the needs for our largest customers, regardless of plan. We also do not have a general admin community group, so we will often cross-post to inform the most members we can.

Regarding Trello and BitBucket, they are not fully in scope for these migrations. Trello Enterprise will be a part of the new experience, and net new workspaces in Bitbucket will also see the new views.

[Tere Pile]

@Vikki Ulmer one last question (I think).  Any chance this update fixes the long existing audit log bug?  

[michelle_bachmann]

This article states that "...An organization admin is the highest level of admin and can complete any administrative task in Atlassian Administration..." With this change, there is no mention of the Billing Admin.

Today, during my monthly licensing and billing review, I discovered that I no longer have access to any of the billing portals, as I once did. The Billing Admin permissions are now greater than Org Admin. They are not functioning properly. As an Org Admin, I cannot even adjust the permissions for the Billing Admin.

https://support.atlassian.com/subscriptions-and-billing/docs/understand-billing-administration/

[Elior Ashkenazi]

Can we initiate this change somehow in our tenant or just wait for the change to happen?

[Alex Hall]

I'm testing a user that is setup as a Product Admin. When that user logs in, they DO NOT have access to make changes to groups with Product Admin access. Multiple support articles implies that Product Admins should be able to manage Product Admin access.

https://support.atlassian.com/user-management/docs/what-are-the-different-types-of-admin-roles/

https://support.atlassian.com/user-management/docs/give-users-admin-permissions/

We're trying to reduce the number of Org Admins we have, but if Product Admin/User Access Admins can't manage Product Admin access, then we're not going to be able to move away from Org access. Is Atlassian working on this?

[Esther Strom]

@Vikki Ulmer is there a way to fast-track the changeover? We're in the planning stages of an instance consolidation and have real need for the user access admin role.

[Mark J Cunningham]

For the Product Admin role, is there a way to switch on /off the ability to add items from the marketplace

[Gene Sullivant]

URGENT***We found that a Site Admin with User access admin can't access the Customer list. They can't see if the User requesting a License is already a Customer so they can be migrated. How can this be fixed?

[Mee Wah Moy]

Hi, @Vikki Ulmer - When will the new experience be rolled out for multi-site orgs?

[Eric Tiffany]

As noted in another comment  , I have a similar problem after the new "experience" was foisted on my org.   In my case, I am unable to manage the service management customer accounts that my customers are able to create simply by adding an email as a participant on a ticket.   As a Site-Admin I was able to do this, but now (even with the User Access Admin role specifically created for this purpose) I am unable to manage the users that my customers create.  Brilliant.

One evidiently needs to be an Org Admin - top of the food chain - in order to do this now.

[Stan Spotts]

It's June now, and I'm curious as to when this will happen for us. Are these migrations performed manually on an org by org basis? :)

We really need this to happen soon. We've shifted creation of user accounts to our help desk staff, and not having to give them full Administrator rights to do user management will help us a great deal.

[Joerg]

Hi, 

Do we have an idea when this will be rolled out for multi instance Enterprise customers?

[Erik Vanderstraeten]

I'm also curious when it would be our turn for this.
As mentioned in another comment, this would allow us to just give user management rights for helpdesk staff, without having to give them full admin rights.

[Dan W]

Will the User access admin role also work via API for user updates?