What happens if you exceed your license limit when using Active Directory?

[Helen Griffiths {Capgemini}]

Hello Community :)

What happens to the Atlassian applications when the license limit is exceeded when using Active Directory for authentication? I've read a few articles and experienced this once in Jira when exceeding Jira Service Desk Agent licenses, but we use Crowd for User Mgmt.

How do the applications know how many users have been added into a Group?

In older versions, Confluence went to Read Only and Jira does not allow you to create new issues. Is this the same?

Hope this makes sense.

[Nic Brough -Adaptavist- · Accepted solution]

The "go into a sort of read-only mode" is the same, yes.  No data loss, no locking out, just "can't write issue/page data"

The applications synchronise an internal copy of the user and groups lists when they synchronise from any remote user directory.  So they "know" what users are in a group because they've asked.

[Helen Griffiths {Capgemini}]

Thanks @Nic Brough -Adaptavist- , appreciate your help :)

[Athas Mark]

Follow-up: Only those users that were provisioned after the account limit was reached as set to view-only?  or all users?  (Jira Cloud Question)

[Nic Brough -Adaptavist-]

It's the system that goes read-only.

Cloud is different though, this doesn't apply here.

[Athas Mark]

...ouch!  I would expect our account rep to know the licensing behaviors, but alas... no... Thanks!

[Akshar Nair]

@Nic Brough -Adaptavist-  once the limit has been reached and extra users have been provisioned. If some licenses are made available, how are the provisioned users given access? Is it in alphabetical order etc?

[Nic Brough -Adaptavist-]

No, that's not how licences work. 

You have a licence limit which allows X users to use the system.  You name them in a group (or several of groups) to make them "provisioned".

You can revoke access (and hence reduce your active licence count) by making the users inactive, or removing them from the access groups.

[Akshar Nair]

HI @Nic Brough -Adaptavist-, I wasn't referring to removing them from the groups. Our current setup controls group memberships directly from the AD, and a sync with Jira happens every 5 mins, where group memberships are updated. There is a group test-jira-users that gets application access within Jira, and we assign this group with the AD.

Say we have a license limit of 100 (i.e. 100 users in the group test-jira-users (AD)) and we have reached the license limit. What happens to the users that are added to the group test-jira-users in the AD, and what happens when the sync takes place within Jira? From the thread above it seems to be they have read-only access.

But now say if one of the licenses is freed up, does the 101th user get the new license or is it in alphabetical order etc?

[Nic Brough -Adaptavist-]

Again, you do not give licences to users, that's not how it works.  Please have another read of my previous comment.