Overview and setup

What it is. A licence review tool. It scans your users, shows which paid seats nobody is using, and lets you reclaim them.

Why the gap exists. Atlassian bills per licensed user, not per active user. Nobody sees the difference in the billing screen, and it grows every time someone changes team, leaves, or gets a licence “just in case”.

Who uses it. A Jira administrator opens the app. Before it can do anything at all you also need an organisation administrator to create an API key, once — this is a prerequisite, not an upgrade.

What it does

• Scans your organisation's users, their product access and their group membership into a snapshot, with last-activity dates per product — on demand, or on a schedule so nobody has to remember.
• Imports the admin-console CSV exports instead, when you have them: seconds on tens of thousands of accounts, no API key needed for the data, and three facts a scan cannot reach. See Importing the CSV exports.
• Shows licence utilisation per product, inactivity distribution, a breakdown by email domain — and what Atlassian Guard is billing you for, including accounts whose access lives on somebody else's instance.
• Filters every user by product, account state, how long they have been inactive, paid seat, Guard billing, which sites their access reaches, two-step verification, department, job title, email domain and name.
• Acts in bulk: remove people from access groups, revoke the product licences you pick, grant access back, add people to a group, suspend an account or restore one — from the Users tab or from a scheduled rule. See Browsing and acting on users.
• Automates the same actions daily, weekly, every two weeks or monthly — and re-checks every person live at the moment of acting, so someone who came back after the scan is left alone and counted. See Automation rules.
• Shows who administers what — organisation admins, site admins, product admins — and which of them are dormant or unprotected. See Admin roles.
• Sweeps API tokens: which accounts hold them, which have sat unused for months, and revocation one click away. See API tokens.
• Records every action, per user, with the result, the reason it was skipped, and who or what asked for it — searchable, filterable and exportable. See Audit log.

Read this before you touch anything

Set it up

1. 1Install the app and open Jira → Apps → License Waste Manager.
2. 2Go to Settings and connect the Organization API: paste your organisation ID and an API key created at admin.atlassian.com → Settings → API keys, then click Test Connection.
3. 3Set the Default Inactivity Threshold. 90 days is a sensible start.
4. 4Fill in Protected Entities: your admin accounts, the org-admins and site-admins groups, service accounts, and any domain that must never be touched.
5. 5Go to Dashboard and click Scan Users, with the scope left on Licensed users only.
6. 6Read the numbers. Then go to the Users tab and look at the actual names before you act on anything.

What happens without an app licence

Three things need an active licence: starting a scan, running a bulk action, and running a rule (by schedule or with Run Now). Everything else stays open, on purpose — a lapsed subscription should not lock an administrator out of data they already collected.

• The snapshot you already have stays readable: the dashboard, every filter on the Users tab, and Export CSV.
• The audit log stays readable, including the per-user detail behind each entry.
• Settings stay editable: the API connection, the inactivity threshold and the protected lists.
• Force Unlock still works, so a job interrupted on the last day of a trial does not leave you stuck.

An unlicensed installation shows a warning at the top of the page — “This app does not have an active licence” — and greys out the three buttons above, each with a line under it saying why. A site administrator can start a trial or renew from the Atlassian Marketplace.

The five tabs