Manage user access to units
This feature is currently in beta and is gradually rolling out. It may not be available to all organizations at this time.
When you set up units, organization and unit admins can group apps and users to ensure knowledge stays within a unit's collaboration boundary.
Managing access involves:
Unit access: Determines which unit a user belongs to. This affects who they can @mention, what they see in Rovo, and which teams they can join.
App access: Determines which specific Atlassian apps a user can use within that unit.
Each app belongs to a unit. Users become part of that unit when they're added to the unit, they are part of a group added to the unit, or provisioned through allocation policies.
Scope and permissions
User access is shared between organization admins and unit admins.
Access permission | Organization admin | Unit admin |
|---|---|---|
Invite users to unit | ✅ | ✅ Only for the unit they administer. |
Manage unit groups | ✅ | ✅ Only for the unit they administer. |
Assign unit admins | ✅ | ✅ Only for the unit they administer. |
Remove users | ✅ | ✅ Only for the unit they administer. |
SSO/SCIM | ✅ | ❌ |
Unit admins should contact their organization admin when:
A user needs to be assigned as a unit admin for a new boundary.
There are issues with user provisioning or SSO that affect the entire organization.
Manage users within a unit
Add a user to unit
Organization admins can add users to any app or group in a unit. Unit admins can only add users for the unit they administer.
To add a user to a unit:
Go to Atlassian Administration. Select your organization if you have more than one.
Select Units in the side navigation.
Select a unit to view its details.
Go to the Users tab, and select Invite users.
Enter the email addresses for the users you want to invite.
In the Apps tab, assign a role to at least one app or add them to at least one group.
Personalize their invitation if you wish to.
Select Grant access to confirm.
Alternatively, organization admins can also add users from the Directory page:
Go to Atlassian Administration. Select your organization if you have more than one.
Select Directory, then Users.
Select Invite users.
Enter the email addresses for the users you want to invite.
In the Apps tab, filter by units that you want to assign the user to.
Assign a role to at least one app or add them to at least one group.
Personalize their invitation if you wish to.
Select Grant access to confirm.
You can create groups within a unit to manage bulk access. Unit admins can create and manage these groups to grant app access locally, without needing organization-wide permissions.
Organization admins configure allocation policies in Atlassian Administration to select the users and groups provisioned into each unit. When a user is provisioned through allocation policies, these rules automatically place them in the correct unit. Understand how to build an allocation policy
To view which units a user has access to:
Go to Atlassian Administration. Select your organization if you have more than one.
Go to Units in the side navigation.
Select a unit to view its details.
Open the Users tab and select the user’s name.
In the Unit access tab, you'll see all units the user has access to.
When users need access to multiple units
If a user requires access to multiple units, you can either grant them access to each unit separately or provision access to multiple units through a single allocation policy. Their search, @mention and Rovo agent will be context-dependent based on the app they are using.
Remove a user
Organization admins can remove users from any unit. Unit admins can only remove users for the unit they administer. Removing a user revokes their access to all apps within the unit while retaining all content they created.
To remove a user:
Go to Atlassian Administration. Select your organization if you have more than one.
Go to Units in the side navigation.
Select a unit to view its details.
In the Users tab, select Action (…) against the user’s name you want to remove.
Select Remove user.
What users can access within a unit
Users have the following access within a unit:
When working across apps (like creating a Jira issue from Confluence), users only see sites in their unit
Hovering over a link will only show a preview if the object exists within the same unit boundary.
When selecting sites or adding smart links, options are limited to the current unit to prevent accidental data exposure.
When viewing recent activity, the "Recent" list in Home or in-app navigation surfaces content from the unit.
When users invoke Rovo (
/rovo), they can only discover and interact with data within their unit.When using automations, actions stay within unit boundaries.
Notifications are limited to activities and content within the unit.
When accessing multiple units, users can switch between them using the unit switcher.
Was this helpful?