If your license limit exceeded after switching YouTrack and Upsource to the same Hub

General use case

YouTrack and Upsource were migrated to an external Hub and resulting user amount there exceeds one of the services license.

Why Does It Happen

At the moment, a user account counts against the license of a service (YouTrack, Upsource, Hub), if this user is granted _any permission_ for this service.
When you migrate YouTrack and Upsource to the same external Hub, roles with the same name from different services may be merged. Which means that the merged role get permissions from all the services. Thus, all users with such merged role will be counted against your license.

Solution

To solve problem when you have reached limit of one of the licenses, you need to remove excessive permissions from users who should not have access to a service but got it after the migration to the external Hub.

Note: Before you begin, please download and install the latest Hub build. 

Please pay attention to these steps to eliminate undesired permission assignment:

1. Remove undesired permissions from the "All Users" group.

By default, the "All Users" group (from which users cannot be removed) may have the default Observer role. After migrating to a single external Hub, this role may include enabled permissions from both YouTrack and Upsource (if Observer roles were merged during the migration, for example). This means, that all users automatically get permissions in all services, which may cause exceeding license limitations.

In this case, if you do not need all users to have permissions from a service (YouTrack or Upsource or both), you should remove any role with permissions from the desired service the "All Users" group. Alternately, edit the Observer role to disable permissions from the specific service. Otherwise all user accounts will be counted against both YouTrack and Upsource licenses.

2. Remove undesired permissions from the "Registered users" group.

By default, all user accounts are added to the "Registered users" group. This group may also have the Observer role and, thus, all new users automatically get permissions in YouTrack service. Remove the Observer role from the "Registered users" group, otherwise everyone in this group will be included in YouTrack and Upsource license.

3. Check if any role got permissions from both services after the migration

Check if after migration you have any roles which has both services permissions (for example you can get them after merge). Check to which groups there roles assigned and make sure that users from there groups should really have access to both services. If not so - edit roles to have only permissions in required service. To find all roles with permissions from particular service, use a search query like the following one on Roles page:

permission(service: <service name>)"

Such query will display all roles that include permissions from the specified service and thus affect the license for this service. Any user granted with such roles will be counted against the service's license limit.

4. Create separate roles with desired Upsource-only and YouTrack-only permissions enabled and assign these roles only to groups of users which should have access to corresponding services.

Example

Use case:
YouTrack has 15 users and Upsource has free license (10 users). Both services were migrated to a single external Hub. After the migration:
- License limitations for both YouTrack and Upsource are exceeded, if you've assigned some default roles like Developer, Project admin or System admin to more than 10 users.
- All 25 users (15 from YouTrack and 10 from Upsource) got the Observer role and that used all YouTrack license.

Solution:

1. Remove the Observer role from "All users" group or edit it not to have Upsource and YouTrack permissions. Also, remove Developer, Project Admin or even System Admin roles from that group if any of these are assigned.
2. Remove Observer role from "Registered users" group. Alternately, edit the role and disable service specific permissions from Upsource and YouTrack. Also, remove Developer, Project Admin or even System Admin roles from the group, if any.
3. Make sure that any other user group with with permissions in both services contains only desired user accounts.
4. Create separate role with Upsource permissions and separate role with YouTrack permissions and assign these roles only to user groups you want to have access to corresponding services.