User deactivation on Data Center

[Dick]

Hi dear Community,

I'm flummoxed. We're running Jira Data Center 9.12.11. We have about 30 accounts that have never logged in, are removed from our LDAP synchronization (from Active Directory), yet still count as active license users.

The Atlassian Help page is referring to the ... menu behind the user having an "edit" function. I'm sad to say that such menu is not available to me (Jira admin privileges). 

Also, others seem to have difficulty with this. The answers given there also mention the edit button that's not to be found on my instance.

So how am I deactivating these users?

Kind regards,

Dick

[Dick]

Normally, a user sync does inactivate the users that were excluded from these special groups we use in the Active Directory. 

The never-logged-in users should've been deactivated (I painstakingly went through all the nested groups and constructed a PowerShell script that would gather the persons in all referred groups. 

I'm wondering which mechanism in Jira is keeping them from deactivating properly. Moreover, if it is something I can influence/amend. 

Kind regards,

Dick

[Radek Dostál]

Due to group membership. You'd need to remove them from groups granting application access.

Ideally, the user sync should inactivate them, but that depends on your particular setup. You can't edit users that are "managed by external directory". You'd have to disable the user details sync from the directory, then deactivate them, then re-enable the user details sync again.

Either way if you remove their group memberships they won't be able to login, or, they will only be able to access JSM portals if you have JSM installed.

In most cases, user sync won't remove users from local groups - which is what those groups that give application access are (unless you reconfigured it to use dynamic groups, rather than use the jira-software-users and such that come out of box).

[Dick]

This behavior is weird:

• Checking with the user, he had no permission to enter Jira. 
• User has a "never logged in" status when looking him up.
• I provide access by placing him in a correct Active Directory group
• User has access and logs in for me 1 time
• User has 1 inlog count with the correct date.
• I remove access by removing him from the afore mentioned AD group
• User has no access anymore
• User doesn't get an [X] denomination as to being inactive, is counted as a licensee.

What am I missing here?

Dick

[Radek Dostál]

But if the user has no access, and is not in any application access groups, then he doesn't count towards the license.

As to why he doesn't get tagged with [X], I assume because he's still in AD, therefore there's no reason for the sync to rename the user or do anything with him.

[Dick]

My problem is that this user is counted as having a license (and thirty others as well). 
I do not have control over this, which creeps me out a bit.

Kind regards,

Dick

[Radek Dostál]

No application access groups = no license.