Understand the role of unit admin

This feature is currently in beta and is gradually rolling out. It may not be available to all organizations at this time.

A unit admin is a delegated administrative role responsible for managing a specific unit. They manage their own teams and tools within a unit without needing full organization-level permissions.

Who should be a unit admin

Organization admins can delegate unit administration responsibilities to people who:

manage user access for a specific unit
configure apps and settings that only affect their specific unit
monitor compliance and data residency with an organization admin

In the original user management experience, when you enable units, site admins become unit admins. Their permission scope shifts from managing a single site to managing the unit boundary within which that single site resides.

Roles and responsibilities of a unit admin

Unit admins have broad authority within their assigned unit, including:

Manage users and groups: Invite users to the unit, create and manage unit-scoped groups.
Administer apps: Add apps for their specific unit and manage unit-level app settings.
Assign roles: Assign the unit, site, app and user access admin roles to users in the units they administer.
Monitor audit log: View audit logs for activities occurring within their unit boundary.
Connect sites: Manage the connection between sites in their unit (for supported configurations).
Marketplace app installation: Unit admins can install and manage apps within their unit's scope. They are installed per site and scoped to the unit where they're added.

Unit admins are restricted from:

Organization-level settings: They can’t manage billing, global security policies (like SSO/SCIM), or organization-wide audit logs.
Creating or deleting units: Only organization admins can manage the lifecycle of the units themselves. However, unit admins can can create and manage sandbox units for eligible organizations.
Cross-unit management: They cannot view or manage users, apps, or sites in units they are not assigned to.

Assign a unit admin

Organization admins can assign a unit admin who’ll manage the users, groups, and apps within a single unit.

To assign a unit admin:

Go to Atlassian Administration. Select your organization if you have more than one.
From the side navigation, select Units.
Select a unit to view its details.
From the unit details page, select the Users tab.
Select More actions ( … ) against the user you want to assign the role to.
Select Assign unit admin.

Once assigned, unit admins can view the Units page in Atlassian Administration. From here, they can manage their specific collaboration boundary.

You can also assign the unit admin role from the user profile of a specific user, and through the Invite users screen.

Remove a unit admin

An organization admin can remove unit-level administrative permissions.

Go to Atlassian Administration. Select your organization if you have more than one.
From the side navigation, select Directory then select Users.
Select a user from the list.
Use the filters or search to find a specific user to view their profile.
Select More actions ( … ) in the top right.
Select Manage unit admin role
Add or remove the unit admin role for this user for any units in this list
Select Save to save these changes

Compare unit admin permissions with other admin roles

Manage units

Feature	Organization admin	Unit admin	Site admin	User access admin	App admin
View the list of units in the organization	✅	Can only see their unit in relevant surfaces.	❌	❌	❌
Create units	✅	❌	❌	❌	❌
Delete units	❌ Requires Atlassian Support during open beta	❌	❌	❌	❌
View unit audit logs	✅	Only within the unit they administer.	Only within the unit that contains the site they administer.	❌	❌
View site usage	✅	Only within the unit they administer.	Only within the unit that contains the site they administer.	❌	❌
Manage service accounts	✅	❌	❌	❌	❌
View and create sandboxes	✅	Only within the unit they administer.	❌	❌	❌
Manage backups for apps	✅	Only for aps within the unit they administer.	❌	❌	❌
Manage data transfer within or between units	✅	Only for aps within the unit they administer.	❌	❌	❌
Manage data residency	✅	Can only view data residency of the unit they administer.	Can only view data residency of the site they administer	❌	❌

Manage users

Feature	Organization admin	Unit admin	Site admin	User access admin	App admin
View users in the organization	✅	Can view users of the unit they administer.	Can view users only within the unit that contains the site they administer.	Can view users only within the unit that contains the app they administer.	❌
Invite users	✅	Can invite users to the unit they administer.	❌	Can invite users only within the unit that contains the app they administer.	❌
Add and remove users	✅	Can add or remove for the unit they administer.	❌	Can add or remove users only within the unit that contains the app they administer.	❌
Configure app access settings	✅	❌	❌	❌	❌
Update managed accounts	✅	❌	❌	❌	❌
Manage portal-only accounts	✅ Requires a Jira role to view portal accounts	Can manage accounts for the unit they administer. Requires a Jira role to view portal accounts	✅ Requires a Jira role to view portal accounts	❌	❌
Make another user an organization admin	✅	❌	❌	❌	❌
Make another user a unit admin	✅	Only within the unit they administer	❌	❌	❌
Make another user a site admin	✅	Only within the unit they administer.	❌	❌	❌
Make another user a user access admin	✅	Only within the unit they administer.	❌	❌	❌
Make another user an app admin	✅	Only within the unit they administer.	❌	✅ Exception: For the Jira family, only an organization admin can make another user an app admin.	❌
Make another user a project and space admin	❌	❌	❌	❌	✅
Export users	✅	Only within the unit they administer.	❌	❌	❌

Manage groups

Feature	Organization admin	Unit admin	Site admin	User access admin	App admin
View groups in the organization	✅	Can view groups of the unit they administer.	Can view groups only within the unit that contains the site they administer.	Can view groups only within the unit that contains the app they administer.	❌
Create a group	✅	Can create groups to the unit they administer.	❌	Can create groups only within the unit that contains the app they administer.	❌
Add and remove users from a group	✅	Can add or remove for the unit they administer.	❌	Can add or remove only within the unit that contains the app they administer.	❌
Configure default groups for Atlassian apps	✅	Only within the unit they administer.	❌	Only within the unit that contains the app they administer.	❌

Manage Atlassian apps and Marketplace apps for a unit

We give organization admins the user and app admin roles for every Atlassian app in their organization automatically, but these roles can be removed. The organization admin role on its own doesn’t grant app access or the ability to configure app settings.

Feature	Organization admin	Unit admin	Site admin	User access admin	App admin
Access Atlassian apps	❌ Organization admins get the user role for every Atlassian app in their organization. The organization admin role itself doesn’t grant app access.	❌ Unit admins get the user role for every Atlassian app in their unit. The unit admin role itself doesn’t grant app access.	❌	❌	✅ Exception: Jira app admins don’t get app access automatically. Grant access to Jira separately.
View apps in the organization	✅	Only within the unit they administer.	Only within the unit that contains the site they administer.	Only within the unit that contains the app they administer.	❌
Add an Atlassian app	✅	Only within the unit they administer.	Only within the site they administer.	❌	❌
Grant access to apps	✅	Only within the unit they administer.	❌	Only within the unit that contains the app they administer.	❌
Approve or deny an access request	✅	Only within the unit they administer.	❌	❌	❌
Configure Atlassian app settings	❌	❌	❌	❌	✅
Add a Marketplace app or connector	✅	Only within the unit they administer.	Only within the site they administer.	❌	❌ Exception: App admins can add a Marketplace app if it’s free and doesn’t require permission to act on a user’s behalf.
Link a Bitbucket workspace to an organization	✅ Must also be the Bitbucket workspace admin.	❌	❌	❌	✅ Must also be the organization admin.

Manage security

Only organization admins can manage security and settings across the organization. Unit admins can see which settings apply to their unit but cannot change them.

Feature	Organization admin	Unit admin	Site admin	User access admin	App admin
Set up and manage user provisioning	✅	❌	❌	❌	❌
Set up and manage SAML and SSO	✅	❌	❌	❌	❌
Manage authentication policies	✅	❌	❌	❌	❌

Was this helpful?

It wasn't accurateIt wasn't clearIt wasn't relevant

Still need help?

The Atlassian Community is here for you.

Ask the Community