Automation when user removed from project

[Anna Chilińska]

Hi,

I need an expert help in a specific case :) In JIRA Software Cloud, users in project admin role can administer their project: add and remove users in Project Settings - People section (they do not have JIRA admin privileges). 

I would like to send the automatic notification to JIRA Admin, everytime a user is added/removed from the project. 

Reason:

a) if the added user has no JIRA license yet, JIRA admin must grant the JIRA license. 

b) if the removed user has only access to the project, JIRA admin can remove his/her JIRA license

I see no possibility to achieve it with modifying notification scheme, creating automation or even with a custom plugin... I do not want to extend Project Admin permissions to administer all JIRA users neither. 

Could you please advise? 

[Bill Sheboy · Accepted solution]

Hi @Anna Chilińska 

How actively do you want to manage this level of user change?

I ask, because a Jira Admin can update roles / access such that only the Jira Admin can add or remove user access.  Then any invite requests will send a notification to Jira Admin(s) for action.  There is no need for additional automation to do this.

Regarding removing access from those who no longer need it, I have managed this in the past by periodic checks of user activity, rather than by to which projects they are assigned.  For example, check monthly for lack of activity and then deactivate the user.

Kind regards,
Bill

[Anna Chilińska]

Hi @Bill Sheboy , 

Thank you for your answer. 

I would like to let Project Admins autonomously manage users in their project, without the need of requesting it every time to JIRA Admin.  But, on the other hand, I do not want to give them permissions for the whole JIRA :) In short, I would like to automate it as much as possible, to save the time. 

So ideally: 

When user is added to the project by project admin

a) if added user has already JIRA Software license - no action 

b) if added user has no JIRA Software license - automatically create ticket with the request/send the info to JIRA Admin etc. 

When user is removed from the project by project admin

a)  if removed user is assigned to any other projects - no action.

b) If removed user is not assigned to other projects - automatically remove his JIRA Software license 

Currently, I'm asking for ticket everytime a new user should be added or removed and I'm also checking periodically for users activity. 

K.r.,

Anna

[Anna Chilińska]

Might be an important info: all our internal users are Customers for JIRA Service Management product and Users for Confluence. It means that as a Project Admin, you can add any internal user to your project (as all employees have Atlassian account) BUT you won't know if the user has JIRA Software license or not.

[Bill Sheboy]

I do not believe there is a way to leverage the built-in notification for a user access requests to then create a Jira issue.  You may want to investigate the Atlassian Marketplace to determine if there are addons to help with this type of user management.

Another possible approach to handle the removed users is to set up a webhook for the global audit log for user and project changes, monitor that with another application to then scan user permissions, and deactivate the user.  This aligns with what @Hauke Bruno Wollentin was suggesting, only they noted using ScriptRunner rather than an external log processing application.  That would require quite a bit of using the admin REST API functions, and so finding a marketplace app may be easier.

[Hauke Bruno Wollentin · Accepted solution]

I can't test it out since I run Jira Cloud only on the free plan but my rough idea is:

With the ScriptRunner Plugin you will be able to create a listener that listens for the Project updated event.

This event provides sadly only the project key and ID, but as an action in the listener you could ask the audit log API for the last change log item (filtering for user stuff) for that project and then process the response output to send notifications to your admins.

[Anna Chilińska]

Hi @Hauke Bruno Wollentin ,

Thank you for your answer.

I would like to avoid buying ScriptRunner, however I'll keep your answer if we decide to go for it :)

K.r.,

Anna