What to do if your license limit is exceeded after switching YouTrack and Upsource to use the same Hub

Typical scenario

YouTrack and Upsource were migrated to an external Hub and the resulting number of users exceeds that of one of the licenses.

Why did it happen?

At the moment, a user account counts against the license of a service (YouTrack, Upsource, Hub) if a user has _any permission_ for this service. When you migrate YouTrack and Upsource to the same external Hub, roles with the same name from different services may get merged, giving those roles combined permissions for all services. All users with such role will be counted against your license.

Solution

To solve this issue you need to remove excessive permissions from users who got it after the migration, but shouldn't in fact have access to a service.

Note: Before you begin, please download and install the latest Hub build. 

1. Remove undesired permissions from the "All Users" group.

By default, the "All Users" group (from which users cannot be removed) may have the default Observer role. After migrating to external Hub, this role may include enabled permissions from both YouTrack and Upsource (if Observer roles were merged during the migration, for example). This means that all users automatically get permissions for all services, exceeding license limits.

If you don't need all users to have permissions for a service (YouTrack or Upsource or both), you should remove any role with permissions for that service from the "All Users" group. Alternatively, edit the Observer role to disable permissions for the specific service.

2. Remove undesired permissions from the "Registered users" group.

By default, all user accounts are added to the "Registered users" group. This group may also have the Observer role, thus giving all new users permissions for YouTrack and Upsource. Remove the Observer role from the "Registered users" group, otherwise everyone in this group will be counted against YouTrack and Upsource licenses.

3. Check if any role got permissions from both services after the migration

Check if after migration you ended up with roles that have permissions for both services. Check which groups these roles are assigned to and make sure that users from these groups should really have access to both services. If this is not the case, edit the roles to only include permissions for the required service. To find all roles with permissions for a particular service, use a search query like this on the Roles page:

permission(service: <service name>)"

The query will display all roles that include permissions for the specified service thus affecting the license for this service. Any user holding such roles will be counted against the license limit.

4. Create separate roles with desired Upsource-only and YouTrack-only permissions enabled and assign these roles only to groups of users which should have access to corresponding services.

Example

YouTrack has a paid license for 15 users and Upsource has a free 10-user license. Both services were migrated to external Hub. After the migration:

• License limitations for both YouTrack and Upsource are exceeded, if you've assigned some default roles like Developer, Project Admin or System Admin to more than 10 users.

• All 25 users got the Observer role.

Solution:

1. Remove the Observer role from "All users" group or edit it to not have Upsource and YouTrack permissions. Also, remove Developer, Project Admin or even System Admin roles from that group if any of these are assigned.
2. Remove Observer role from "Registered users" group. Alternately, edit the role and disable service-specific permissions from Upsource and YouTrack. Also, remove Developer, Project Admin or even System Admin roles from the group.
3. Make sure that any other user group with permissions in both services contains only desired user accounts.
4. Create a separate role with Upsource permissions and a separate role with YouTrack permissions and assign these roles only to user groups you want to have access to corresponding services.