Getting Started

Installation

You install it like any other Atlassian Marketplace app. Go to marketplace.atlassian.com, search for "Jira Governance Admin Helper," and click Get it now. You'll be prompted to pick which Atlassian site you want to install it on — select yours and confirm.

After installation, the app shows up in two places. First, in the left sidebar under Apps when you're in Jira — look for "Jira Governance & Admin Helper" near the bottom of the apps list. Second, you can reach it through Jira Settings > Apps > Manage apps if you want to check the license status. If you don't see it in the sidebar immediately after install, give it a minute and refresh. Forge apps sometimes take 30–60 seconds to register in the navigation after a fresh install.

The trial is free for 30 days with no credit card required. Once it expires you'll need a paid Marketplace subscription. The app shows a license required screen if you open it after the trial ends.

Who Can Access

You need to be a Jira site admin — not a project admin, not a JSM agent, not a board admin. Site admin means you have the global ADMINISTER permission for the Jira site. The easiest way to check: click the gear icon in Jira's top navigation. If it opens a settings page with menus like Users, Projects, Issues, and System, you're a site admin. If you only see project-level settings, you're not.

Non-admins don't see the app in the sidebar at all. If someone finds the URL and tries to open it, they get a permission error. There's nothing visible or accessible to them.

You also need an active Marketplace license. The 30-day trial is free with no credit card. Once the trial ends, you'll see a "License Required" screen when you open the app until a subscription is activated.

Finding Your Way Around

When you open the app, you'll see a left sidebar with navigation groups. Each group covers a different area of Jira administration. Clicking any item loads that section in the main area — the sidebar stays in place throughout.

Governance

This is where most admins spend most of their time. Work Item Configuration is the main audit and cleanup tool — it scans your instance across workflows, custom fields, permission schemes, notification schemes, screens, priorities, and more, then lets you bulk-delete the unused ones. Also here: Audit Log Analyser (search and filter Jira's built-in audit log), Automation Rules (manage rules at scale), Attachments (JQL-driven attachment search and delete), Components (per-space component cleanup), and Releases (per-space version management).

Views & Boards

Spaces gives you a full list of all your Jira spaces with metadata — work item counts, space type, lead status, and scheme assignments. Dashboards & Filters audits dashboard and filter ownership and flags items with inactive owners so you can do a bulk transfer. Agile Boards lists all Scrum and Kanban boards with their admin accounts and associated filters.

Scheme Manager

Four dedicated bulk assignment tools, one per scheme type: Permission Schemes, Notification Schemes, Workflow Schemes, and Work Item Type Schemes. Each follows the same 3-step wizard. If you need to move 300 spaces to a new permission scheme after a company reorg, this is where you do it.

People & Access

Bulk Role Manager assigns users or groups to space roles across multiple spaces at once. Role Report shows who has what roles and how they got them (direct assignment vs. via a group). User Management loads your full user list with product access and last-active data, plus bulk actions (suspend, delete, revoke access). Group Management manages Jira groups via the Atlassian Admin API. Teams covers Atlassian team memberships.

Help & Settings

Settings is where you configure the Organization API key, set bulk limits, and adjust the activity log retention period. Activity Log shows a history of actions performed through this app specifically. Support has contact info and links to this documentation.

Your First 10 Minutes

When you first open the app the sidebar can seem overwhelming — there's a lot there. Here's a sensible path through it for the first session.

1. Start with Work Item Configuration

Click Work Item Configuration in the sidebar. You'll see a row of tabs at the top — Workflows, Work Types, Fields, Permissions, Priorities, Notifications, Screens — each with a badge that shows the item count once it loads. Click Scan All to run everything at once. On a typical instance this takes 30–60 seconds. The tabs fill in progressively as each section finishes.

Start with the Workflows tab once it loads. Switch to the Details sub-tab and look at how many workflow schemes have 0 spaces assigned to them. On any instance that's been running a few years you'll usually find a surprising number. The same pattern applies across all tabs — the "In Use" column tells you what's actively referenced by any configuration. Anything not in use is a safe candidate for cleanup.

2. Check the Audit Log

Click Audit Log Analyser under Governance. Set a date range — start with the last 30 days — and click Search. You'll see a table of configuration events: who changed what, when, and what the change was. Click Details on any row to see exact field-by-field changes. This is genuinely useful for answering "who changed this permission scheme last week?" when your team is trying to track down an access issue.

3. Load your users

Click User Management, then click Load Users. This fetches the basic list quickly — usually under 10 seconds even for large instances. Once the table appears, click Load Access & Activity. This is the slow scan — it checks every user's group memberships, product access, and last login dates. On a 5,000-user instance expect around 3 minutes; 15,000 users takes around 8 minutes. A progress bar tracks it and the table populates as each chunk completes, so you're not staring at a blank screen the whole time.

4. Try a bulk scheme change

If you have spaces that need a permission scheme update, go to Permission Schemes under Scheme Manager. Load the space list, use the filters to narrow to the spaces you want, select them, pick the new scheme, review the preview showing current vs. new scheme per space, and click Apply. Each space shows success or failure in real time. The whole flow takes about 2 minutes once you've identified your targets.

5. Set up the API key if needed

If you need to suspend or delete users, view last-active dates, or manage groups, you'll need the Organization API key. Go to Settings and follow the setup steps. It takes about 2 minutes and unlocks the user lifecycle management features. If you don't need those, skip this step — everything else works without it.

Setting Up the API Key

Before you start: the key you need comes from admin.atlassian.com, not from id.atlassian.com. This is the most common point of confusion. The key at id.atlassian.com is a personal API token for your individual Atlassian account — it's used for things like automation or Jira scripts. The Organization API key at admin.atlassian.com is a site-level credential for org-wide admin operations. They're completely different.

You also need to be an Organization Admin to create this key — not just a site admin. If you can log in to admin.atlassian.com and see the Settings menu, you're an org admin. If you can only manage one specific Jira site but not the overall org, you'll need to ask your org admin to create the key.

1. Log in to admin.atlassian.com Sign in and make sure you're in the right organization if you manage more than one.
2. Create the API key Go to Settings > API keys > Create API key. Give it a recognizable name (e.g., "Jira Admin Helper") and set an expiry date. The app doesn't auto-rotate keys, so set a calendar reminder to renew it before the expiry date — an expired key causes the key-dependent features to quietly stop working.
3. Copy the key immediately You only see the full key once. Copy it before closing the dialog. If you miss it, you'll need to create a new one.
4. Find your Organization ID While still in admin.atlassian.com, look at the URL — it contains a UUID that's your Organization ID. It looks like d90a038j-62jc-18a6-jka2-1jjc17d23d75. Copy that as well.
5. Enter both in the app's Settings Open the app, go to Settings, paste both the API key and Organization ID, and click Save. The app validates the key, shows whether it worked, and auto-detects your primary user directory.

Once saved, the key is encrypted in Forge's secret storage. The browser never receives the raw key value — Settings shows only a "Configured" status indicator. The key isn't logged anywhere on the server side either.

What the API key unlocks

• Suspend user accounts at the org level (blocks login, account preserved and reversible)
• Delete users via the Admin API (permanent — not reversible)
• Last Active dates per Atlassian product in User Management
• Inactive owner detection for dashboards and filters
• Group Management — create, delete, bulk add/remove members
• Product access revocation

Data & Caching

When you load data in the app — users, spaces, workflows, boards — it stays in your browser tab's memory for that session. Switching between tabs in the app doesn't re-fetch anything. Close the tab and it's gone; you'll load it fresh next time.

The only things that persist between sessions are your Organization API key (encrypted in Forge's secret storage) and the Activity Log. Everything else — user lists, space lists, scan results — is session-only and disappears when you close the tab. Use the Rescan and Load buttons to refresh data whenever you need an up-to-date picture.

Security Overview