We get attacks on a regular base. I can recommend to enabled Captchas. Feature would be handy though.

I have a bit of a better view of this missing feature now. First of all, a straight-up DELETE of users is a risky operation b/c that results in actual removed tuples and potential relational DB problems. So maybe allowing for that in the GUI admin console in bulk is not a great idea, and there is some wisdom requiring this operation to be performed by an admin that can understand/handle the SQL operation.

However, what should exist, is a bulk DEACTIVATE option, which is what I really needed when I first came across this request. And in that case, I get all conspiracy theory about it, because Jira licenses are priced based active user count, so a bulk deactivate is a feature that reduces revenue. That seems obvious enough that I probably shouldn't call it a conspiracy. How often do any of us build things with revenue-reducing potential?

Is there a legitimate explanation as to why this is not a base feature? Why do I have to fork out an additional $100 just to have this extremely basic option, that even Redmine has?

@arne2: Refer to JSDSERVER-5706 for more tips and tricks to remove the unwanted users.

We have been attacked by what appears to be russians. They have created more than 400 unique accounts in our service desk. We need a way of deleting these accounts safely.

There is a new plugin that allows bulk user delete. It's called "Bulk User Delete for Jira" and it available on Marketplace: https://marketplace.atlassian.com/plugins/com.empyra.bud.BulkUserDeleteforJira/server/overview

Because "You can now bulk delete users" doesn't look great on a list of new features.

Here's a script I made to bulk delete users through the REST API and curl. Any users who are a reporter, assignee, or shared filters/dashboards will not be deleted (limitation of Jira, you have to remove those first). Give it a filename list a list of users, one username per line.

#!/bin/bash

# CONFIG
# Give these values to skip prompts

adminuser=
jira=

# END CONFIG

if [ $# -ne 1 ]; then
	echo "Usage: $0 infile"
	exit 1
fi

infile=$1
if [ ! -r $infile ]; then
	echo "Can't read file: $infile"
	exit 1
fi

if [ -z $jira ]; then
	echo -n "Jira Base URL:"
	read jira
fi

if [ -z $adminuser ]; then
	echo -n "Username:"
	read adminuser
fi

echo -n "Password:"
read -s adminpass
echo

cmd=DELETE
api=/rest/api/2/user

while read u; do
	echo -n "$u: "
	curl --insecure --silent --show-error -u $adminuser:$adminpass -X $cmd -H "Content-Type: application/json" "$jira$api?username=$u"
	echo
done < $infile

How is it that this is still not a feature!?!?

I need to delete over 1000 users from our Jira instance. Not to go all conspiracy theorist...but that action would take our annual Jira license bill from 48k to 12k, and that seems to be a reason to park a feature like this for 12-and-a-half years.

I have to totally agree with Haddon. I would go with "it's 2005, do your homework"

I know that front-end development is awesome and so cool because there you get recognized. But what is a shiny front-end with shitty administrative features. Guys that was basic stuff back in 2005 and it is still not implemented.

In my opinion the role as an administrator got way harder with the new UI, because you can't find anything anymore, therefore when I found something I want to get things done very quickly not loose twice as much time.