ACP-120 Domain 1: User Features (10-15%) - Complete Study Guide 2026

What Is Domain 1 and Why It Matters

Domain 1 of the ACP-120 exam is titled User Features, and it carries a weighting of 10-15% of the total exam score. On a 75-question exam, that translates to roughly 8 to 11 questions - a meaningful portion that can swing your result above or below the 63% passing threshold if you treat it as an afterthought.

Despite being the smallest weighted domain on the exam, Domain 1 is foundational. Nearly every other domain assumes you already understand how users exist, authenticate, and are managed within Jira Cloud. If you're unclear on how Atlassian accounts work or how user management interacts with site-level access, you'll consistently lose points on scenario questions in larger domains like Domain 3: Product and Project Access and Permissions (30-35%).

This guide covers exactly what's inside Domain 1, how Atlassian phrases User Feature questions, which admin actions are most commonly tested, and how to sequence this domain into your broader ACP-120 preparation.

Core Topics Inside Domain 1: User Features

The ACP-120 Exam Topics document (v3, April 2021) defines what must be tested within User Features. Candidates should expect questions covering the following areas:

These aren't abstract concepts. The exam presents each topic as a realistic admin scenario. You'll be told what situation exists - a user left the company, a contractor needs access to one project, an account can't be found - and you must choose the correct administrative action from four or five plausible options.

User Management Deep Dive: What the Exam Actually Tests

Inviting vs. Adding Users

In Jira Cloud, the distinction between inviting a user and adding a user through a directory is fundamental. When you invite someone directly through Jira Cloud, they receive an email invitation and must accept it to activate their Atlassian account. When your organization uses SCIM provisioning through an identity provider, users can be pushed automatically without a manual invitation step. The exam tests whether you understand which pathway is in use and what the administrator's responsibilities are in each scenario.

Deactivation and Its Downstream Effects

A deactivated user in Jira Cloud cannot log in, cannot be assigned new issues, and does not consume a billable seat - but their historical data, comments, issue assignments, and audit trail entries remain intact. The exam frequently presents a scenario where an administrator needs to handle a departing employee and asks which action preserves data integrity while removing access. Choosing "delete" instead of "deactivate" will cost you a question, because deleting a user in Jira Cloud removes their account and can orphan content in ways that deactivation does not.

Managed vs. Unmanaged Accounts

This is one of the more nuanced user feature topics. An Atlassian account is considered managed when the organization has claimed the domain associated with that email address through Atlassian Access (now part of Atlassian Guard). Managed accounts give the organization admin additional controls: enforcing SSO, resetting passwords, and controlling product access centrally. Unmanaged accounts belong to the individual and cannot be controlled by the org admin in the same way.

Exam questions on this topic tend to present a situation - "a user signed up with a company email but IT cannot enforce SSO on their account" - and ask why this is happening or what step is needed to resolve it. The answer almost always involves domain claiming or Atlassian Guard configuration.

Atlassian Account Mechanics and Access Controls

Jira Cloud is built on Atlassian accounts - a centralized identity layer that spans all Atlassian products. This architecture is meaningfully different from Jira Server or Data Center, where users were managed in a local user directory or connected LDAP. The ACP-120 exam is explicitly a Cloud exam, and questions in Domain 1 will assume you understand this cloud-native identity model.

The admin.atlassian.com Portal

Many user-related administrative actions happen at the organization level, not inside the Jira product itself. The Atlassian admin portal at admin.atlassian.com is where org admins manage users across all products, configure identity providers, enforce security policies, and view organization-wide audit logs. Jira site admins have product-level access management but cannot control managed account settings from within Jira alone.

The ACP-120 tests this layering deliberately. Expect scenario questions that describe an admin trying to perform an action inside Jira's user management interface that can only be completed at the org admin level - and vice versa. Understanding which tasks belong where is essential.

SCIM Provisioning and External Directories

Organizations using identity providers such as Okta, Azure AD, or Google Workspace often provision Jira Cloud users automatically through SCIM. When SCIM is active, user creation, deactivation, and group membership may be controlled entirely outside of Jira. The exam expects candidates to know that in a SCIM-provisioned environment, manually creating or deactivating users inside Jira can cause sync conflicts - and that the correct administrative action is to manage users through the identity provider, not directly in Jira.

Groups, Roles, and the User Feature Connection

User Features doesn't exist in isolation. The practical application of user management always connects to how those users receive access to Jira projects and data. While the deep permissions content lives in Domain 3: Product and Project Access and Permissions, Domain 1 introduces the building blocks: how users are organized into groups and how group membership affects product access at the site level.

Site-Level Product Access Groups

In Jira Cloud, product access is governed by membership in specific groups. By default, Jira Cloud creates groups like jira-software-users, jira-servicemanagement-users, and jira-administrators. Adding a user to the appropriate product access group grants them a license seat and the ability to log in to that product. Removing them from the group revokes access without deleting their account.

Domain 1 questions may ask which group a new contractor should be added to for read-only project access, or what happens when a user is removed from all product access groups but their Atlassian account is not deactivated. These seem like simple questions but require precise knowledge of the group-to-product-access relationship.

The Distinction Between Product Access and Project Permissions

A user must have product access (via group membership) before project-level permission schemes matter at all. This sequencing - product access first, then project permissions - is a common source of exam confusion. Domain 1 owns the product access layer; Domain 3 owns project-level permissions. Understanding where one ends and the other begins will help you correctly answer questions in both domains.

How Domain 1 Questions Are Written on the ACP-120

The ACP-120 uses multiple-choice, multiple-response, and scenario/configuration-reasoning items. Domain 1 questions almost always appear as scenarios - you'll rarely see a simple "what is the definition of X" question. Instead, you'll see formats like:

• "A Jira administrator receives a request to remove access for a user who has left the organization. The user has open issues assigned to them and is mentioned in several comments. What should the administrator do?"
• "An organization admin has enabled SCIM provisioning with Okta. A Jira admin tries to add a new user manually in Jira but the user doesn't appear after the next sync. What is the most likely cause?"
• "A new contractor needs access to two specific Jira Software projects but should not have access to any other projects or products. What is the correct sequence of steps?"

In each case, the question tests your ability to reason through a realistic admin situation - not recall a fact. The wrong answers are always plausible. They'll include actions that would work in Jira Server, actions that are technically possible but incorrect in the given context, and actions that sound right but target the wrong layer of the admin hierarchy.

For a broader look at how the ACP-120 structures its scenario questions across all eight domains, see the Best ACP-120 Practice Questions 2026: What to Expect on the Exam guide - it breaks down question construction patterns and how to approach elimination strategies.

Building Domain 1 Into Your ACP-120 Study Sequence

Given that Domain 1 is foundational but not the heaviest domain by weight, the right approach is to study it early and integrate it with your Domain 3 preparation rather than treating it as a standalone block. Here's a practical sequence:

For a complete week-by-week schedule covering all eight domains, see the ACP-120 Study Guide 2026: How to Pass on Your First Attempt.

Domain 1 vs. Other ACP-120 Domains: Scope and Priority

As this table shows, Domain 1's 10-15% weight makes it a mid-tier investment of study time relative to Domain 3's 30-35%. However, no other domain makes conceptual sense without Domain 1's groundwork. Study it early, not last.

For a full breakdown of how all eight domains fit together and what percentage of your score each one represents, see the ACP-120 Exam Domains 2026: Complete Guide to All 8 Content Areas.

Frequently Asked Questions