If you've ever added users to Jira Server or Data Center and somehow--whether due to a migration, a new team, or a new job--you find yourself needing to add/administer users in an Atlassian Cloud instance, there will be a few things that will leave you scratching your head. Cloud is a slightly different beast, and as such, you'll want to familiarize yourself with the key differences between Cloud and the on-premise deployment options that Atlassian offers (i.e. Server and Data Center).
Some Cloud Structure
Let's kick this off with an overall look at the hierarchical structure of Cloud. At the highest level, there's the organization. It can have one or many sites. Each site can have one or many products. Each product can be made available to some, all, or none of the users who have access to other products on other sites. Then we've got our end users who have their own slew of privileges based on the configurations within each of the products they can access.
Organization Administrator
The Organization Admin is at the top of the chain as far as administration is concerned. They can verify domains with Atlassian (i.e., @abcglobal.com and @abcglobal.co.uk), set security, for example, with Atlassian Access (if this is your SAML, SSO tool of choice for example), designate other Organization Admins, edit user accounts, etc. See the whole list here. Again, this is the administrator who has visibility into the Atlassian products that span the entire organization.
Organization Admins access their admin panel at admin.atlassian.com
In smaller organizations, the organization administrator is also very likely to be the site administrator, Jira Administrator, and an end user. However, the larger your organization is, and the more robust your organization's needs/products are, the more likely it is that different people will fill these roles.
Short of having one or many federated instances of Atlassian products overseen by your VP of IT, for example, there isn't really an equivalent role to the Organization Administrator for our Server and Data Center friends.
Site Administrator
The next rung down the ladder (or next one up, depending on your point of view) is the site administrator. This should not be confused with who you may know as the System Administrator in your Server or Data Center versions of Jira. There is no such thing as a System Administrator in Jira Cloud. Rather, you can consider the System Administrator to be Atlassian themselves.
The Site Administrator mainly manages products, users, groups, billing, and paid apps from the marketplace for the site (all of these things can also be done by the Organization Administrator as well). Typically, your site admins are not in the business of creating Jira projects and adjusting their configuration schemes. That kind of work is handled by the Jira Administrator (Product Administrator).
Like Organization Administrators, Site Admins also access their admin panel at admin.atlassian.com
Product Administrator
As far as Jira is concerned, the Product Administrator is pretty much the same as what you know to be the Global Permission "Jira Administrators." However, in Jira Cloud, the Global Permission is instead called "Administer Jira." Maybe the switcharoo of the wording order will bring clarity. Time will tell. Either way, when Jira is first stood up and turned on, this Global Permission is enabled by default for all users in the "jira-administrators" group.
The title "Product Administrator" is a bit more all-encompassing in the Cloud world, I suppose, considering that one site can have many products, each with its own administrator. If nothing else, the term Product Administrator helps to distinguish Site Administrators from those administrators who are otherwise configuring the products (creating Jira Projects, spaces, etc.).
Product administrators access their admin panels the same way end users access the tool, by going to <mysite>.atlassian.net.
Trusted User
The first time you switch from adding a user into a Server instance of Jira, to inviting a user to a Cloud instance of Jira, I can almost 100% guarantee that you'll be stopped dead in your tracks by this wacky "Trusted User" business. This is because there isn't really anything quite like it in the Server or Data Center versions of Jira.
You've got Basic, Trusted, and Site Administrator as your choice of roles into which you can drop your newly invited user. The Basic role is pretty straightforward. It will give the user access to the product(s) that you've specified. The Site Administrator option will make the user a site admin. Fair enough.
So what is Trusted all about? Trusted will give the user access to all the products on your site AND they can access the admin.atlassian.com product settings page. But when they get there, they're really only able to invite other users to one or many of the products on the site. The users that a Trusted user invites are only ever added as Basic.
One other item to consider is that once a user is listed as being in the Trusted role, this won't change if you add them to the jira-administrators group. So when sleuthing, troubleshooting, or otherwise tinkering with users and their settings, be sure to double-check their groups to understand their actual global permissions.
Default groups a Trusted user is dropped into. Cody is properly trusted.
However, this can change and they'll still be shown as Trusted.
For more info on adding users to Jira Cloud, be sure to reach out to your friendly Atlassian experts at Isos Technology. We're always happy to chat with you about this topic, or any others that you may have questions about, when it comes to your Atlassian instance(s).