Need to cleanup of empty user and not is use groups in Atlassian Org

[Sanam Malleswari]

Hi,
I am an Atlassian Org Administrator currently working on a large-scale cleanup task involving over 8000 groups within our organization. Many of these groups have zero members and appear to be unused.
I’m looking for best practices to efficiently identify and safely remove these empty or inactive groups without affecting any active product permissions, project roles, or space restrictions. Within this Atlassian Org having Jira Software, Jira work management, confluence are there in enterprise plan and Jira Product Discovery in standard plan.
If anyone has experience with similar group management at scale—especially using the Atlassian Admin API, automation scripts, or other safe approaches—I'd really appreciate your guidance and suggestions.

[Piyush Annadate _ACE Pune_]

Hello @Sanam Malleswari ,
In this case, best would be to do this programatically. 

Create a python script (chatgpt at best)
- Fetch all the Groups via rest api - /rest/api/3/groups/picker 
- You will have all the groups and their IDs
- Get the count as members of the group using the Group ID from above using those GROUP ID via rest api 
- Dump the above data into csv file
- Verify the FILE data.
- Post verification, write a script to delete the group using their Group ID via rest api  by parsing csv having Group ID.

Note: You cannot have Group list via the user export; export won't have those group which aren't having any user membership.
- Make sure you verify your data prior deletion; also make sure you do not remove group having product access (just on safe side - anyhow you can delete it)

Now for the groups in use - (my vision)
- The group to be deleted, you can actually, create another script to parse every permission scheme, security scheme,  notification scheme other schemes, having groups in those, collate those group id/name listing into a csv using the same groups to be deleted

ex.
Group Name - Group ID - Permission Scheme Count - Notification scheme Count - security Scheme Count
Group Name 123 - fknjernkjgkjn324 - 3 - 1 - 0 

Above denotes, group existing in 3 times in permission schemes, 1 in notification scheme and 0 in security scheme as count; based on that you can actually reconstruct the groups to be actually deleted.


Give a try, that will help you to explore the API section and python  process. 

Still in doubt - Copy my answer and paste into Chatgpt, that would give you my thought process.

[Sanam Malleswari]

Hi @Piyush Annadate _ACE Pune_ ,
Thanks. I will try.

[John Funk]

Hi Sanam,

If the groups are empty, then they can be safely removed, and should be. 

You can take a look at some of the user related apps in the Marketplace apps to see if they can help you. You can do a free trial and be done in a couple of days. 

[Sanam Malleswari]

Hi @John Funk ,
Thanks for your response. Could you please suggest any app, if you known any apps?

[John Funk]

https://marketplace.atlassian.com/apps/1230481/automated-user-cleanup-deactivation-for-jira?hosting=cloud&tab=overview

[Petru Simion _Simitech Ltd__]

Hi @Sanam Malleswari ,

I would not advise to use any app to automatically remove users from permission schemes, remove users from grouips  or delete users. You could easily end up with a regretable mess.

You need to do your analysis and manually remove users or alter your permission schemes, not before backing up your sistem and creating reports of what permission schemes, groups users and roles users were before your changes.

While depicting the users in group might be a bit challenging, depicting the users that have permissions in permission schemes in projects because they are part of roles will prove real challenging. This because while users are added to groups by admins, globally, users are added to roles for each specific project not by a Jira admin but by one of the project admins.

If you are open to using apps you can use Roles Dashboard for Jira , an app developed by our company.

You can search for one or multiple projects and one or multiple roles.

You ca visualise the search result in two perspectives:

Project - User - Role Perspective

User - Role - Project Perspective

You can export your results in csv format for further Excel reporting

Regards, 

Petru

[Kieren _SmolSoftware_]

Hi @Sanam Malleswari 

You've got two great ideas already, but I wanted to ask how your site came to have 8000 groups?

Depending on your answer, there might be some processes or checks you want to do to ensure the groups aren't recreated (such as an IdP syncing/creating the groups) or to ensure erroneous groups aren't created in the future.

[Sanam Malleswari]

Hi @Kieren _SmolSoftware_,

We did cloud migrations from 2-Jira/confluence servers to single cloud Jira/confluence by using lift and shift method.
We haven't cleaned up any data before migration. Later, we noticed under atlassian org cloud.