Atlassian Organizations consolidation - Expectations and requirements
Platform Notice: Cloud - This article applies to Atlassian products on the cloud platform.
Whenever you are looking to consolidate Atlassian organizations (transfer all products/sites from one organization into another), you will go through different phases to complete it.
Since the process happens mostly on the Atlassian side and different requirements can surface to accomplish the migration, this KB article will help you prepare and set expectations to make the process happen.
Atlassian Organizations and User Management - Different experiences
Before starting, let's get some intro to understand the basics and understand the basics of an Atlassian Organization. From "Get started with an Atlassian organization”:
Your Atlassian organization is where you find your company-wide administration settings. You get started with an Atlassian organization in one of two ways: 1) signing up for a new Atlassian product or 2) creating an organization without products.
In addition, Atlassian Organizations have different experiences due to the differences between the centralized and original user management. While "What is an Atlassian Organization?" and Navigate the Atlassian administration provide detailed context, we can summarize them into different points:
Centralized user management
Unified User Base: Users and groups are managed centrally across all sites within an organization. This means a single user directory is shared across all sites, simplifying user management.
Centralized Administration: User and group management is done through a central directory in the administration hub, rather than individually for each site.
Simplified Access: A single invitation grants users access to multiple products, and user details are accessible across all products.
Group Management: Groups are managed centrally, and any non-synced groups with the same name across sites are renamed to avoid conflicts.
Limitations: Once centralized user management is enabled, individual sites can't be transferred between organizations, and disabling it requires deleting all but one site.
Original user management
Isolated User Base: Each site within an organization manages its own user base separately, allowing for more isolation between sites.
Site-Specific Administration: User and group management is done individually for each site, which can be beneficial for organizations needing isolation for privacy or compliance reasons.
Separate Access: Users are invited to individual products, and user details are specific to each product.
Group Management: Groups are managed separately for each site, providing flexibility but requiring more administrative effort.
Benefits of Isolation: This model is preferred by some large organizations that require separation of users and content across different regions or projects.
The original user management will also receive updates to bring feature parity with the centralized version. For more information, see https://community.atlassian.com/t5/Enterprise-articles/An-update-on-the-centralized-user-management-experience-rollout/ba-p/2881501.
Organization Consolidations
Knowing what Atlassian Organizations are, you might want to consolidate all your sites and users into a single one. However, consolidating organizations involves technicalities and does not necessarily make sense for your business.
If you are considering consolidating or not, you must first ask: "Can I merge my Atlassian organizations?”. By following this link, it will you with subjects such as:
If it's technically possible to merge the organizations
If your organization has multiple sites
If you already have the centralized user management
If you have Atlassian Guard subscription
If it makes sense to your business
The benefits behind the process
Reasons that you might want to not consolidate them
Opting to move only selected products between them
Before requesting the consolidation
Aligned with Transfer all products to another organization - Plan for the transfer and Can I merge my Atlassian organizations?, it’s important to understand what is behind the process:
The consolidation process merges sites, products, and users from the source to the destination organization.
We merge org admins in the consolidation process, and the org admin from the source organization will become the org admin in the destination organization after the merge. If groups with the org admins have product access, this may cause a license limit breach of that product.
If the same account/user is inactive in the target organization, the user in the merged organization will also be inactive, hence losing access to the same product before the merge.
If you want the user to maintain the same access as before, we suggest first removing the user from products in the org where the user was inactive before the merge and then activating (un-suspending) the user.
The process is not reversible. After the consolidation, you can't split the target organization back to the two original organizations.
During consolidation, the administration hub of both organizations will be in read-only mode to prevent any changes.
If more than two organizations are requested to be consolidated, there must be a minimum of 24 hours of wait before the next consolidation occurs.
Consolidation should be finished in around 4 hours without issues. However, this is only after all the requirements are completed.
If there are any groups with the same name in both organizations, the group(s) from the source organization will be renamed during the consolidation process using the following format:
{groupName}--{SourceOrgName}
The group that grants org admin permissions (either org-admins or site-admins) in the source organization will be renamed to legacy-org-admins–{SecondaryOrgName} during the consolidation and will no longer grant any administrative permissions.
The consolidation is usually executed on Tuesdays, Wednesdays, or Thursdays between 9 a.m. and 12 p.m. Sydney time.
If you are planning to consolidate your organization or have questions about it, feel free to contact our support team at support.atlassian.com/contact.
Pre-consolidation requirements
There are requirements that must be fulfilled in order to unblock the transfer, either in the target or source organizations. While support will be in touch to help validate it, to be prepared and avoid back and forth, be aware that:
Both organizations should be in the centralized user management.
Both organizations should have one common organization admin.
No accounts from Atlassian support should be in your organization (e.g. by consent granted through support tickets).
The total number of sites in the secondary org should be less than 20.
The secondary organization should not have any siteless products like Trello or Bitbucket.
The total number of users, groups, and group membership should be less than 180,000.
Reset the User Access Settings in the secondary organization.
- No users should have a status conflict between both organizations (e.g. user in Org A is Active while the same account in Org B is Inactive).
Since groups should be renamed during the consolidation process (e.g., having the same name in both the source and target organizations), make sure to remove any JQL filters that include the groups and/or remove the group from your schemas in case they are in IT Service Management (ITSM). We have a feature request to improve how you can self-serve, including a workaround.
Remove any inactive users present in the groups to avoid license breaches.
If you already have a ticket open with the support team, we will contact you to identify and resolve any requirements. You can do this yourself or, in case of any blockers, support might ask for approval (parte omitida) to do it on your behalf.
Support will be also assisting you to ensure that no accounts from Atlassian are in your organization, which can block the process.
Aside from these requirements, you must also go through Transfer products to another organization - Transfer checklist: configurations and subscriptions to remove and recreate.
Expectations through the process
The consolidation relies on unblocking the requirements first, meaning that the total time, including all planning, may take a couple of business days to complete. In some cases, it can take over a week to be completed. Once you are unblocked, as shared above, the consolidation itself should take around 4 hours.
Through the process, support will guide you through different phases to make it happen:
Information gathering
Although it might already be completed, support will check for information related to both target and source organizations. For example, what is highlighted in Can I merge my Atlassian organizations? and Transfer products to another organization - Transfer checklist: configurations and subscriptions to remove and recreate.
Migrating to the centralized user management
One of the main factors is ensuring that both organizations have the "Centralized User Management." Converting to "Centralized User Management" has different requirements such as:
The Administration Hub will be in read-only mode while the change happens if the organization has more than one site. No changes or downtime will happen within the products.
To enable it, Site Admins and Trusted Users must become organization admins or become regular users.
Once it’s enabled, be aware of the following implications:
Instead of each site in the organization having its own separate user base to manage users and groups, the organization will have a single user base for users and groups that are shared with all sites in the organization. As such, all users will exist on all sites in the organization, regardless of whether they have access to any products on those sites.
Users and groups for all sites in the organization will be managed via the Directory tab in the administration hub instead of the individual user management for each site.
The Domains menu to manage their verified domains will move from the Directory tab to the Settings tab of Admin Hub.
The Administrators menu under the Settings will no longer exist. Instead, you can manage users' organization administrator permissions via the Users page under the Directory tab.
Similar to the above, if there are multiple sites in the organization that have non-synced (IDP) groups with the same name, the groups will be renamed on one or more sites to append the site name.
You will no longer be able to transfer individual sites from other organizations to this organization or any individual sites from this organization to another organization.
If you want to disable the Centralized user management experience, you must delete all but one site from the organization.
Pre-flight checks
We will run pre-flight checks to identify the conditions highlighted in the Pre-consolidation requirements session. This is one of the parts where we expected a bit of back-and-forth since we must ensure that there are no more blockers.
Please avoid making the changes related to these blockers(e.g. adding non-org admin user to site admins; new groups) until we migrate you to Centralized user management. Otherwise, this can create a new blocker and delay the migration.
Dry Run report
A Dry Run report simulates the consolidation without making any actual changes, providing a detailed preview of what will happen during the actual consolidation. Here are some key points about the Dry Run report in this context:
Purpose: It is used to inform you about the expected changes, such as which users will be changed to inactive after the merge. It serves as a debugging tool and helps in identifying any potential issues before the actual consolidation.
Process: After a successful pre-flight check (mentioned above), a "Dry Run" report is generated. This report is shared for review and approval. If no objections are raised to the changes outlined in the report, the consolidation job can proceed.
Content: The report often includes technical details related to alphanumeric values (e.g., AAIDs, Group IDs, site IDs) that may need to be translated into more understandable terms for the customer. Support will be more than happy to translate that.
Approval: The consolidation process can't proceed without your approval of the Dry Run report. This ensures that all parties are aware of and agree to the changes that will occur.
Timing: Ideally, the consolidation should take place shortly after the Dry Run report is provided and approved to minimize disruptions and ensure a smooth transition.
Post-transfer checks
Once the consolidation is done, you should check details such as user access, group names, licensing details, and, most importantly, all reconfiguration (e.g., domain verification, enabling SSO, connecting with IDPs).