iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To migrate Jira users and groups without escalating permissions, first audit destination group names and identity management, then choose the migration scope and whether to preserve memberships. Review Cloud app access separately from Jira project permissions, and manually reconcile later membership removals: a repeat migration adds newly seen members but does not remove members already in Cloud.
Why group migration can change access
A group is more than a list of names: membership can determine whether someone can access an Atlassian Cloud product, and Jira roles and permission schemes determine what they can do inside Jira. Moving a group with unintended members—or matching it to a same-named Cloud group—can therefore grant access beyond the intended set.
Atlassian’s Jira Cloud Migration Assistant is its recommended free tool for moving from Jira Server or Data Center to Cloud. Atlassian describes it as “the easiest and most reliable way” to migrate; that is Atlassian’s characterization, not the result of independent comparative testing. See Atlassian’s migration-method guidance. Match the assistant version used in production to the version used for the test migration.
Recommended Free Tools
Plan identities before moving project data
Atlassian recommends migrating users and groups before project data where practical. Doing so reduces work during project cutover and lets users begin using Cloud while projects continue to move. For large instances, Atlassian specifically highlights this approach for instances with more than 2,000 users; the documentation does not provide a publication year for that threshold.
#1 Best Overall
Inventory the destination
- Confirm the source is Jira Server or Data Center and identify the exact Cloud site.
- Determine whether Cloud groups are managed directly or synchronized from an identity provider or directory.
- Inspect existing Cloud groups and other Atlassian instances for duplicate names before migrating.
- Check email readiness and how existing Cloud accounts correspond to source users.
Cloud accounts are associated with email addresses. If a source user’s email already belongs to a Cloud account, migration links the Jira data to that account rather than creating a separate one. Confirm that these matches are intended. Atlassian’s users and groups migration guidance explains the behavior.
Resolve group-name collisions
Existing Cloud groups can be linked by name. A same-named group may combine members from separate sources, so names are security-relevant match keys, not just labels. Pay particular attention to common names such as admins: Atlassian warns that same-named groups can be merged, combining users and access. Rename or otherwise resolve unintended collisions before migration, especially for repeated or multi-instance moves. See Atlassian’s Cloud user and group management guidance.
Rank #2
- Used Book in Good Condition
Prepare directory structure
Cloud does not support nested groups. If source groups are nested, flatten membership in the identity provider or directory-sync path before relying on those groups in Cloud. Also establish which system is authoritative for membership so manual Cloud corrections are not later overwritten by synchronization.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Choose timing, scope, and membership deliberately
The assistant supports advance migration of users and groups, or identity migration alongside project data. When migrating with project data, the choice is between all users and groups and those associated with selected projects. The referenced-only scope can optionally include project-role assignees and members of included groups; without those options, a person not referenced elsewhere may be left out.
| Decision | What to choose | Access implication |
|---|---|---|
| Timing | Migrate users and groups in advance, or with project data. | Advance migration reduces identity work on project cutover day. |
| Identity scope | All users and groups, or only those associated with selected projects. | Referenced-only migration may omit role assignees or group members unless their inclusion options are selected. |
| Membership | Preserve group memberships or migrate identities without relying on preserved memberships. | Preserved memberships can grant product or project access and affect license counts. |
| Identity management | Direct Cloud group management or synchronized identity-provider management. | Nested groups must be flattened; confirm the system that will own ongoing membership changes. |
Choose scope against the projects, roles, workflows, and permission schemes being moved—not only against the user list. If project access is meant to remain restricted, verify who will be included through role-assignee and group-member options before running the migration. Atlassian documents the options in its advance migration guidance and user and group selection guidance.
Run the migration and review access in separate layers
- Test the planned move. Use the same Jira Cloud Migration Assistant version intended for production and validate identity matching, group-name handling, and the selected scope.
- Migrate identities. Where practical, migrate users and groups before project data, using the scope and membership choices established during planning.
- Review proposed Cloud app access. The assistant migrates group app-access settings but does not apply them until an administrator reviews and approves them. Approval affects billing, so do not treat the migration of a setting as approval to grant access.
- Check Jira authorization separately. Review project roles, permission schemes, and granular Jira permissions. App access determines whether a user can open a Cloud product; it does not by itself establish the user’s permissions within Jira.
- Configure global access manually. Global settings and global site permissions are outside this tool’s migration scope and need manual setup.
Atlassian explains the distinction and migration behavior in its users and groups guidance and Cloud user and group guidance.
Reconcile memberships after every later migration
Do not use another migration run as a membership synchronization mechanism. Atlassian says a re-migration adds newly seen users to an existing group but leaves existing Cloud membership as-is. If a person is removed from a source group, that removal is not reflected automatically in the destination.
- Compare source and Cloud membership after source-side additions, removals, or other group changes.
- Manually apply removals and other intended changes to the equivalent Cloud group.
- Audit app access and Jira permissions after reconciliation, before moving more projects or relying on the Cloud site.
Handle identity and repeat-migration edge cases
Disabled, deleted, or inactive-directory users
Users disabled on Server can migrate as active Cloud accounts without app access. Deleted users, or users in inactive directories who are referenced in Jira data, can appear as “Former user.” If those references need to migrate as user identities, Atlassian advises reactivating the user or directory before migration. These cases are described in Atlassian’s users and groups documentation.
Project roles after a repeated move
On repeated migrations, project roles are not removed when a Cloud project is deleted. Migrating that project again can create a role with a “(migrated)” suffix; inspect and clean up such roles manually if they are no longer needed.
Check the live guidance before cutover
Atlassian support pages can change, and the pages cited here do not display publication dates. Verify the current assistant behavior and Cloud identity setup in Atlassian’s live documentation before a production move.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →
