To migrate Jira users and groups without escalating permissions, check the destination Cloud site for existing accounts and same-named groups before moving data; choose identity scope and group-membership handling deliberately; then review Cloud app access and Jira project permissions as separate controls. Atlassian also warns that a later migration run adds newly seen group members but does not remove people removed from the source, so membership changes need manual reconciliation.
Plan the identity move before project data
For migrations from Jira Server or Data Center to Cloud, Atlassian recommends moving users and groups in advance where practical. That reduces work during project cutover and lets users begin using Cloud while projects are still being moved. Atlassian identifies the Jira Cloud Migration Assistant as its recommended free tool for these migrations; use the same assistant version in production that you used for the test migration. See Atlassian’s migration-method guidance.
As an Amazon Associate I earn from qualifying purchases.
Before starting, establish which Cloud site is the destination, whether identities are managed directly in Atlassian Cloud or synchronized from an external directory, and whether other Atlassian instances will also be migrated. The Cloud migration journey calls out user preparation, licensing, duplicate group names, and Cloud user-management setup as planning items: plan your migration.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Audit group names as access controls
Cloud groups with names matching source groups can be linked during migration. If a same-named group already contains destination users, a migration can combine membership rather than create a clean, separate access boundary. This matters especially for common names such as admins and for repeated or multi-instance migrations: membership and access from groups with the same name may be combined. Inventory destination groups and resolve collisions before you run the assistant. Atlassian explains the behavior in its users and groups migration documentation and Cloud group-management guidance.
#1 Best Overall
Prepare accounts and group structure
Verify email addresses and existing Cloud accounts
Cloud accounts are associated with email addresses. If a user’s email address already exists in Cloud, migration links the Jira data to that account rather than creating a separate account. Confirm that addresses are usable and that the existing destination account is the intended person before migrating.
Flatten nested groups
Atlassian Cloud does not support nested groups. If a source group inherits members from another group, flatten that membership in the identity provider or directory-sync path before relying on it in Cloud. Also check whether groups are synchronized from an external directory, since that affects where membership changes must be made and maintained.
Rank #2
- Used Book in Good Condition
Choose who migrates and whether membership follows
The migration assistant offers different identity scopes depending on whether you migrate users in advance or alongside project data. Choose based on the projects and access rules being moved, not simply on the number of accounts.
| Choice | What it includes | Access consideration |
|---|---|---|
| Advance user and group migration | All users and groups; group membership and Jira Service Management customers can be included optionally, according to Atlassian’s advance-migration guidance: perform an advance migration. | Preserving membership can grant product or project access and affect license counts. Decide whether membership should be carried over rather than treating it as a harmless identity-only step. |
| Migration with selected project data | All users and groups, or only those associated with the selected projects. The referenced-identity scope can optionally include project-role assignees and members of included groups: migrate referenced users. | If you omit role assignees or group members, some people may not be included unless they are referenced elsewhere. Consider project roles, workflows, and permission schemes when setting scope. |
Keeping identity migration separate from project-data migration can make cutover easier to stage, but preserving group membership can also grant access sooner than intended. Decide explicitly whether the goal is to create Cloud identities first or to reproduce access at that stage.
Review Cloud app access and Jira permissions separately
Group app-access settings and Jira permissions are different layers. App access determines whether a user can open a Cloud product; Jira project roles, permission schemes, and granular permissions govern what that user can do within Jira. The assistant migrates group app-access settings for administrator review and approval rather than applying them automatically, because approval can affect billing. Review the proposed app access before approving it, then inspect project-level permissions independently.
Global settings and global site permissions are outside this tool’s migration scope and must be configured manually. Identify the required settings before users depend on the Cloud site. Atlassian describes these migration boundaries in its users and groups documentation.
Reconcile group membership after every later migration
A re-migration is not a two-way synchronization. Atlassian says it adds newly seen users to an existing Cloud group but leaves existing Cloud membership as-is. Consequently, removing someone from a source group does not remove that person from the Cloud group on a later run. Reproduce removals and other intended membership changes manually in the corresponding Cloud group, then audit access before moving further projects.
Free tools Windows power users keep installed
One-click scans. No signup required.
Check exceptions before cutover
- Disabled source users: users disabled in Server can migrate as active Cloud accounts without app access. Check their Cloud status and intended access rather than assuming the source disabled state will be replicated.
- Deleted users or inactive directories: references to these identities can appear as “Former user.” Atlassian says to reactivate the user or directory before migration if those references need to migrate.
- Repeated project migrations: project roles are not removed when a Cloud project is deleted. Migrating the project again can create a role with a “(migrated)” suffix, which may need manual cleanup.
- Large instances: Atlassian says migrating users before projects is especially important for instances with more than 2,000 users. The cited page did not display a publication year, so treat this as Atlassian’s planning guidance, not as a dated industry benchmark: large-instance migration guidance.
Use a staged access check
- Before migration: record source users, group memberships, group names, directory synchronization, and the intended Cloud permissions. Resolve destination group-name collisions and confirm account emails.
- During migration planning: choose advance or project-associated identity scope, and decide whether group membership should be preserved. Include role assignees and group members if the selected-project scope requires them.
- After identity migration: inspect the migrated groups and users, review proposed app-access settings before approval, and verify Jira roles, permission schemes, and global permissions separately.
- After source-side membership changes: apply removals and other changes manually in Cloud; do not rely on another migration run to remove members.
Atlassian describes its assistant as “the easiest and most reliable way” to move from Server or Data Center to Cloud. That is Atlassian’s own characterization of its recommended free tool, not an independent comparative test: Atlassian’s migration-method guidance.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
