Atlassian Guard – Issue Syncing Cross-Tenant Users from Entra ID (Azure Integration)

[Nathan Weelen]

Hello,

We’re currently configuring Atlassian Guard to provision users and groups from Microsoft Entra ID to Atlassian Cloud.

Because we rely on nested groups, we chose to set up the integration using the Azure Integration method.

After running the synchronization, here’s what we’re observing:

1. Internal users (company.com & other sub-domain) → Successfully synced
2. External users (B2B Guests) → Successfully synced
3. External users (Cross-tenant synced users marked as "Member") → Not synced. These users are not provisioned. They are also not added to the expected synced groups

It seems that cross-tenant users (present in our Entra ID but originating from another tenant) are not being synchronized. Note that their user type is set to "Member".

I contacted Atlassian Support, and they suggested the following:

"The affected users are currently set as "Member" in Entra ID. Since their domain is not verified in your Atlassian organization, this may create a logic conflict.
Changing their role to "Guest" explicitly identifies them as external collaborators, which can bypass domain verification constraints."

• Has anyone else encountered this issue when trying to provision cross-tenant users via Atlassian Guard?
• Were you able to successfully sync them while keeping their Member status?
• Is converting them to Guest the only viable workaround, or are there alternative solutions?

Any insights, best practices, or confirmation would be greatly appreciated!

Thanks in advance

[Marc -Devoteam-]

Hi @Nathan Weelen 

They can't be synched, as the domain the users being to is not yours and not managed in your guard.

This is also not possible, as your customer might be using this in their Atlassian.

Atlassian is right here.