Can't remove JSM licence from Org Admin

[Richard Blundell]

I incorrectly asked this question in an old thread so am trying again here.

We have two Org Admins, neither of whom are Jira Service Management agents (or, really, Stakeholders or Customers).  We're currently paying for a licence for these users and want to remove this licence from each of them.  However, the UI won't allow this.

Here's the view for one of the users.  Note that they have the JSM "User (agent)" role assigned:

If I go to the ellipsis menu to try to change this, there is a padlock next to the "Remove product access" option at the bottom of the menu:

If I hover over this menu option there's a tooltip that explicitly says I "Cannot remove product access for an organisation admin":

If I click the dropdown for the user's roles and try to deselect "User (agent)"...

... it fails with a toast message:

What am I doing wrong here?  The linked thread, below, says we shouldn't have to allocate and pay for licences to these two people who don't use the product, but I can't remove the licence from them.  We don't want to have to pay for user licences to a product those users will never use.

[My original question was in this thread for the previous question:  

https://community.atlassian.com/t5/Jira-Service-Management/Do-Org-Admins-have-to-be-Agents-in-JSM/qaq-p/2632980]

[Kieren _SmolSoftware_ · Accepted solution]

Hey @Richard Blundell 

There are two roles are play in your question:

1. The JSM Agent role

2. The Org Admin role

Both roles are applied via one or more groups.

The JSM Agent role has a default group, probably called something like jira-servicemanagement-users-nameofyoursite.

The Org Admin role will have a default group called site-admins or org-admins. (I'll assume the group is called org-admins for the rest of this, but just replace the below instructions with whichever group exists in your groups directory...)

Out of the box, the org-admins group will have all the product roles applied to it, as well as all the admin roles. This means when you grant a user the Organization Admin role, that user is put into the org-admins group, they get the org admin role AND they get all the product roles.

You can change this, so that when granting an Org Admin role, ONLY the org admin role is granted and no other product roles:

1. Navigate to your group list in admin.atlassian.com

2. Open your site-admins or org-admins group

3. Remove the product roles from the group

4. Remember, by removing product access from this group, all the users in the group will loose product access. So double check if there are any users that do actually need to keep their product access and add them into another group that grants the necessary product access, or manually grant it via the User Detail screen.

Hope that helps!

-Kieren
Co-Founder @ Smol Software | Ex-Atlassian

[Richard Blundell]

Hi Kieren,

Thank you!

That has done it.  We had seventeen groups, and the last-but-one group (named "site-admins", in our case) contained these two users, plus a bunch of suspended users (ex-colleagues), and this group had the "User (agent)" JSM role applied.

I would never have found that without your answer.

It wasn't clear (to me) from the user-centric area of the UI why it wasn't letting me remove those licences.  The error showed a GUID instead of a group name, which wasn't helpful.

All fixed, and your helpful answer will hopefully also assist others in future.

[Ollie Guan]

Hi @Richard Blundell ,

As a workaround, you might temporarily change the organization admin role to another user, remove the JSM license, and then revert the admin role back.

While this isn't a perfect solution, it's worth a try.

[Kieren _SmolSoftware_]

An addendum to my answer above, in relation to @Ollie Guan's answer

If the org-admins or site-admins group does not have the JSM Agent role on it (as I assumed it did in my answer), then Ollie's answer will work.

If my assumption above is correct however, then the agent role will just be reapplied to the user when you add the Org Admin permission back (since the Agent role is also attached to the same org-admins group)

[Richard Blundell]

Hi Ollie, a very sneaky workaround that.  Crafty thinking, and much appreciated!  I went with Kieren's answer, and it seems to have worked.