Know who and what has access, and what it costs you.

Who it is for

• IT and IAM owners responsible for Atlassian Cloud access, with or without Atlassian Guard.
• Security and compliance leads who need to explain every account before an audit or a renewal.
• Platform owners rolling out Rovo agents who want to know who can create them and what they can reach.

What you get

• Expiring keys and tokens: when your SCIM API key expires (provisioning and deprovisioning stop when it does), and which user API tokens exist, who holds them, and when they expire.
• Single sign-on gaps: managed accounts outside a policy that enforces single sign-on, the exceptions and who approved them, and external users, whom your managed-account policies do not cover.
• Service accounts and integration users with no owner: what each one can reach, what credentials it holds, and who should answer for it.
• Rovo agents: who can create them (by default, anyone with access to Studio), which agents run on their own account instead of the user's, and what app access those accounts hold.
• Idle and duplicate seats: people with app access who have not been seen in months, duplicate accounts from mismatched email attributes, and how your billable user count compares with headcount.
• A written findings list ranked by risk and cost, with a 30-minute walkthrough of what to fix first.

How it works

1. Intro call (30 minutes). We confirm your identity provider, whether you use Atlassian Guard, and the exports and access we need.
2. Review (about 1 week). We work through your exports and admin settings and record every finding with its risk, its cost, and a suggested owner. We do not change anything.
3. Walkthrough (30 minutes). We walk your team through the findings, highest risk first, and name the fixes worth doing this quarter. The findings list is yours to keep.

What we need from you

• An organization admin for a screen-share session, or temporary organization admin access for the review. Several of these settings are visible only to organization admins.
• A user export from Atlassian Administration with app access, group memberships, and last seen dates, plus an export of external users if you have Guard.
• Your current headcount, so we can compare it with the accounts you pay for.
• If you use an identity provider, the users and groups assigned to its Atlassian app.

Related reading

• Why your Atlassian user count is wrong, and it's not headcount: where the extra billable accounts usually come from.
• Atlassian license and user-count reconciliation: the full account-by-account reconciliation, when the check finds a gap.

Questions

Is the identity check really free?

Yes. There is no charge and no commitment. You keep the findings list whether or not we work together.

Do we need Atlassian Guard for this?

No. Without Guard, we still check API tokens, external users, service accounts, agents, and seats. With Guard, we also check your single sign-on policies and SCIM provisioning, since both need Guard Standard or an Enterprise plan.

Why does the check include Rovo agents?

A Rovo agent acts with the permissions of the person using it, or with its own account that admins manage like a user. Either way, its reach depends on your identity setup. Studio lets anyone with access create agents unless an admin limits it, so we check that setting too.

Will you change anything in our organization?

No. We review and report. Every fix waits for your decision, and many are ones your admins can make on their own once the list exists.