Best Practices & Scenarios

This guide provides practical examples, best practices, and advanced scenarios for using bulk operations effectively in User Management & License Optimizer.

Planning and Preparation Best Practices

Before Starting Any Bulk Operation

Test with Small Groups First

• Try operations on 5-10 users before scaling

• Verify results match expectations

• Identify any unexpected behaviors

• Refine approach based on test results

Verify User Selections

• Double-check User Browser filters capture intended users

• Review user list for any unexpected inclusions

• Confirm user count matches expectations

• Check for Organization Admins in selection (they'll be skipped)

Document Operation Purpose

• Record business reasons for the operation

• Note any compliance or security requirements

• Document expected outcomes

• Maintain audit trail for reviews

Check Dependencies and Impact

• Review users' group memberships and site access

• Identify any project ownership or critical assignments

• Check for automated integrations or API usage

• Plan for potential service disruptions

Timing Considerations

Schedule During Low-Usage Periods

• Early morning or late evening for large operations

• Avoid peak business hours

• Consider global timezone impacts

• Coordinate with maintenance windows

Coordinate with Other Changes

• Avoid conflicts with scheduled maintenance

• Plan around identity provider sync schedules

• Coordinate with other administrators

• Check for concurrent automated tasks

Common Use Case Scenarios

License Optimization

Scenario: Quarterly License Cleanup

Business Need: Reduce costs by removing inactive users from expensive applications

Process:

1. Identify candidates: Filter users inactive > 90 days

2. Review by application: Start with most expensive licenses (JSM, Premium features)

3. Manager confirmation: Export list for management review if required

4. Execute in phases:

   • Week 1: Remove access to expensive applications

   • Week 2: Remove access to secondary applications

   • Week 3: Suspend accounts if completely inactive

5. Track savings: Document license cost reductions

Key Considerations:

• Preserve access for users on planned leave

• Maintain documentation access during knowledge transfer periods

• Consider seasonal usage patterns (consultants, contractors)

Scenario: App-Specific License Optimization

Business Need: Optimize specific high-cost application licenses

Example - Jira Service Management Optimization:

1. Filter users: JSM access + inactive > 60 days

2. Analyze usage: Review ticket creation/assignment history

3. Convert to customers: Remove JSM agent access, add to customer groups

4. Maintain basic access: Keep Jira Software access if needed

5. Monitor impact: Track customer experience and cost savings

Employee Lifecycle Management

Scenario: New Employee Onboarding

Business Need: Standardize access for new team members

Standardized Onboarding Process:

1. Identify new users: Filter by creation date (last 7 days) + department email domain

2. Department-specific access:

   • Engineering: Add to engineering-team, dev-tools-access, code-review-team

   • Marketing: Add to marketing-team, creative-tools-access, campaign-managers

   • Sales: Add to sales-team, crm-access, customer-facing-tools

3. Universal access: Add all to company-all-hands, security-training-required

4. Verify access: Test login and application availability

5. Welcome communication: Trigger welcome emails and training schedules

Scenario: Department Offboarding

Business Need: Remove access for departing team members

Phased Offboarding Approach:

1. Week 1 - Sensitive Access Removal:

   • Remove from admin groups

   • Remove from financial/HR applications

   • Remove from production systems access

   • Maintain collaboration tools for knowledge transfer

2. Week 2 - Operational Access Reduction:

   • Remove from project-specific groups

   • Remove from development tools

   • Convert to documentation-only access

   • Transfer project ownership

3. Week 3 - Complete Offboarding:

   • Remove all remaining application access

   • Suspend user accounts

   • Archive user data according to policy

   • Complete audit trail documentation

Contractor and External User Management

Scenario: Project Contractor Management

Business Need: Manage external contractor access for specific projects

Project-Based Access Control:

1. Project start:

   • Filter contractors by email domain

   • Add to project-specific groups: project-alpha-team, external-dev-tools

   • Add to collaboration groups: project-alpha-communication

   • Exclude from internal groups: Remove from internal-only-access

2. Project completion:

   • Remove from project-specific groups

   • Remove development tool access

   • Maintain documentation access for 30 days

   • Convert to customer/guest access if ongoing relationship

3. Contract end:

   • Complete access removal

   • Suspend accounts

   • Document project contributions for future reference

Scenario: Vendor Access Management

Business Need: Control vendor access during engagements

Vendor Lifecycle Management:

1. Engagement start: Add to vendor-limited-access, specific project groups

2. Engagement progress: Add to additional groups as trust/need develops

3. Engagement completion: Remove project access, maintain communication access briefly

4. Contract end: Complete removal and suspension

Security and Compliance Scenarios

Scenario: Security Incident Response

Business Need: Immediate access restriction following security incident

Emergency Response Process:

1. Immediate lockdown:

   • Suspend affected user accounts immediately

   • Document incident details and timestamp

   • Notify security team and management

2. Investigation period:

   • Keep accounts suspended during investigation

   • Preserve audit trails and access logs

   • Document all investigative steps

3. Resolution:

   • If cleared: Reactivate with previous access

   • If violations confirmed: Complete permanent removal

   • Update security policies based on findings

Scenario: Compliance Audit Response

Business Need: Address audit findings about excessive access

Audit Remediation Process:

1. Access review: Filter users by privileged groups

2. Validation: Confirm business need for each high-privilege user

3. Remediation: Remove unnecessary admin access, implement principle of least privilege

4. Documentation: Create detailed records of all changes

5. Follow-up: Schedule regular access reviews to prevent future findings

Multi-Site and Complex Environment Scenarios

Scenario: Site Consolidation Project

Business Need: Migrate users between sites during infrastructure consolidation

Migration Process:

1. Phase 1 - Preparation:

   • Document current access patterns by site

   • Map groups between source and target sites

   • Create migration plan with rollback procedures

   • Communicate changes to affected users

2. Phase 2 - Dual Access:

   • Add users to target site groups

   • Verify access works on target site

   • Test critical functionality

   • Maintain source site access during transition

3. Phase 3 - Cutover:

   • Remove access from source site

   • Verify all functionality on target site

   • Monitor for issues and provide support

   • Document completed migration

Scenario: Geographic Reorganization

Business Need: Restructure access based on new geographic organization

Regional Access Management:

1. Current state analysis: Document existing global access patterns

2. Regional grouping:

   • APAC users: Add to team-apac-leads, access-apac-sites-full

   • EU users: Add to team-eu-leads, access-eu-sites-full, gdpr-compliance-required

   • US users: Add to team-us-leads, access-us-sites-full

3. Global access adjustment:

   • Remove from access-global-sites-full

   • Add to access-global-sites-read for collaboration needs

4. Verification: Test regional access patterns and cross-region collaboration

Advanced Best Practices

Large Organization Considerations

For Organizations with 1000+ Users:

• Batch processing: Limit operations to 100-200 users at a time

• Staging approach: Test in development environment first

• Performance monitoring: Track operation duration and success rates

• Support coordination: Engage support team for optimization guidance

• Maintenance windows: Schedule during dedicated maintenance periods

Complex Multi-Site Environments

Site Relationship Management:

• Document site hierarchy: Understand production, staging, development relationships

• Group mapping: Maintain documentation of which groups provide access to which sites

• Dependency tracking: Understand cross-site group and permission dependencies

• Migration planning: Use systematic approach for site consolidation projects

Automation Integration

Coordinating with Automated Tasks:

• Manual override capability: Use bulk operations for exceptions to automated rules

• Filter consistency: Leverage same saved filters for both manual and automated operations

• Timing coordination: Schedule manual operations between automated task runs

• Documentation alignment: Maintain consistent documentation for both approaches

Troubleshooting Common Scenarios

Partial Operation Success

When some users fail in bulk operations:

1. Analyze failure patterns:

   • Check if failures are user-specific or group-specific

   • Review error messages for common themes

   • Identify any SCIM-managed users in the failed list

2. Common failure causes and solutions:

   • Already in target state: User already suspended or already has/lacks the access

   • SCIM conflicts: Identity provider managing the user/group

   • Permission issues: Insufficient admin rights for specific operations

   • Network timeouts: Retry during off-peak hours

3. Resolution approaches:

   • Retry failed operations with smaller batch sizes

   • Address underlying causes (SCIM conflicts, permissions)

   • Document exceptions for compliance records

   • Consider alternative approaches for problematic users

SCIM and Identity Provider Conflicts

When operations appear successful but don't persist:

1. Identify SCIM-managed resources:

   • Work with identity team to identify which groups are SCIM-managed

   • Document which users are provisioned via identity provider

   • Understand sync timing and frequency

2. Coordination strategies:

   • Make changes in identity provider when possible

   • Time manual operations between SCIM sync cycles

   • Document manual vs. automated management boundaries

   • Set up monitoring for sync conflicts

Operation Sequencing Strategies

Complex Multi-Step Operations

Department Transfer Example:

Security Incident Response Example:

Testing and Validation Workflows

Before Large Operations:

1. Small-scale test: Run on 5-10 users first

2. Validation: Check results in User Browser and test actual access

3. Refinement: Adjust approach based on test results

4. Stakeholder approval: Get sign-off for large-scale execution

5. Full execution: Run on complete user set

6. Post-validation: Verify results and document outcomes

Compliance and Documentation

Audit Trail Best Practices

Documentation Requirements:

• Business justification: Why the operation was necessary

• Approval records: Who approved the changes

• Execution details: When, how, and by whom operations were performed

• Impact assessment: What changed and who was affected

• Validation results: Confirmation that changes worked as expected

Compliance Integration:

• Regular access reviews: Use bulk operations to implement review findings

• Certification processes: Document bulk changes as part of access certification

• Audit preparation: Maintain detailed logs for compliance audits

• Change management: Integrate with organizational change approval processes