nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Add all internal users to directory to access only JSM as customer

Ramon Gamma_la2va6

A organisation licensed Jira, Confluence, JSM, Guard in the cloud for ~1000 users.
The user provision is coming from internal AD and the users are login via SSO. The rest of the organisation (Total ~3000) should be able to access the JSM portal as customer only and login via SSO.

Our idea is to add all the internal users to the Atlassian directory with user provisioning and add them to a group which is having access to JSM as customer.
So all internal users are able to login via SSO to access JSM customer portal.

At the moment we're facing the problem that only the users which are having product access for eg. Jira are showing up in the directory of Atlassian.

We are wondering if users which are not in a group for a paid product (eg. Jira user) are not added/displayed in the directory by Atlassian.
Maybe there is such a limitation for which we are not able to find the documentation.

Accepted answers

Neil Fletcher_sg7dui

Hi @Ramon Gamma

I have a similar setup. The group is created in Azure AD named: <company>_All_Employees
Whenever anyone joins/leaves, they are added/removed from the group.

I'm using the AAD User Principal Name to sync, so we capture all employees with and without a 365 licence.

The group is sync'd to Atlassian and added to the JSM product as a Customer

Then, the same group is added to the JSM project with Role = Service Desk Customers

It allows all employees to access the portal and submit incidents, request etc

All comments

Neil Fletcher_sg7dui

Hi @Ramon Gamma

I have a similar setup. The group is created in Azure AD named: <company>_All_Employees
Whenever anyone joins/leaves, they are added/removed from the group.

I'm using the AAD User Principal Name to sync, so we capture all employees with and without a 365 licence.

The group is sync'd to Atlassian and added to the JSM product as a Customer

Then, the same group is added to the JSM project with Role = Service Desk Customers

It allows all employees to access the portal and submit incidents, request etc

Mariana Silveira Sales

@Ramon Gamma

I don't know if you already check this documentation: https://confluence.atlassian.com/cloudkb/user-provisioning-and-saml-single-sign-on-for-jira-service-management-customers-1333826180.html

but it seems to address this specific configuration.

"The JSM Customer role can be granted during SCIM user provisioning by synchronizing a user group from your external directory or granted when users access the portal using SAML Just-in-Time (JIT) provisioning through configured authentication policies, which will create an Atlassian account at login."

So when syncing the group into Atlassian Cloud, you'll need to setting it as an access group for the Jira Service Management - Customer application access.

Ramon Gamma_la2va6

Thank you for your answers.

From what I see, we are doing it right and the potential issue as to why it actually doesn't work is probably an internal one.

I will forward this to the stakeholders so it can be analyzed and fixed.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

cloud

atlassian-guard

user-directory

jira-service-management-cloud

jira-service-management