Effective Use of Jira Service Management with Microsoft Entra ID for Access Requests

Heyy @Gabriela - LeanZero  ,thanks, this is really helpful. The approach of using Entra group membership as the final access grant makes sense, especially with provisioning and group syncing in place.

Our main focus is connecting the Jira Service Management request and approval flow with Entra, so that once the designated application owner approves the request, the required group membership or access change happens automatically without another manual step.

One thing we'd also like to understand is the SCIM limitations with Atlassian Guard Standard. Are there any limitations around group creation, membership updates, deprovisioning, or product access that we should consider? In particular, what scenarios would still require manual handling even with Guard + SCIM?

We'll also check our Entra ID Governance licensing and evaluate the native Entitlement Management capabilities.

Hi @Emma Phillips, one refinement on what I told you first, since you're building on it. No admin console visit per approval still holds. There is one at the start I skipped over though. A group arriving from Entra lands with no app access on it, and somebody has to grant that group access to Jira Service Management once, by hand. Provisioned users don't inherit it from your default groups either, which is what ACCESS-604 is asking for (Gathering Interest, 336 votes). So pre-create the groups you'll grant and map each one to its product and role up front. Then the approval only ever adds a member.

For the adding part you probably don't need a webhook. Jira automation has a built-in Entra ID connector, with Add user to group and Remove user from a group among its actions, and the predefined ones need no app registration in Azure. The custom-request action is the one that does. A Jira admin makes the connection. It takes a user ID and a group ID, not names. https://support.atlassian.com/cloud-automation/docs/use-entra-id-with-automation/

The trap coming off on-prem AD is nesting. Plain SCIM only sees the immediate members of a group you've assigned to the Atlassian app in Entra, and Microsoft's wording is that the service can't read or provision users in nested groups. Nest anything and the approval succeeds while nobody gets access. Atlassian's Azure AD for nested groups connector covers that, but moving to it later means resyncing every user and group and configuring SAML again, so decide it early. The write into Entra is immediate and the Atlassian side isn't. Provisioning runs on a fixed interval, 40 minutes in the Entra blade, so don't close the ticket on approval.

Deleting someone in Entra deactivates the Atlassian account and billing stops there. The account itself stays. Going the other way is what bites. Delete the Atlassian account while they still exist in Entra and the next sync recreates it.

Past that one-time grant the manual list is short. Group renames don't cross at all, Microsoft's connector limitations say changes to a group's displayName aren't reflected in Atlassian Cloud, so a rename means a new group and a new grant. Only verified-domain users get updates pushed, and moving someone's email to an unverified domain quietly pulls them out of their SCIM groups and can take app access with it. On roles, connecting the identity provider is org admin, but that one-time app grant can sit with a user access admin for the app.

That's what I'd plan around. I wouldn't call it an exhaustive list.

Thanks, @Aditya_miniOrange . This looks quite close to what we're trying to achieve, especially the JSM-based approval workflow with Entra ID provisioning.

I'd also be interested in understanding how the app handles temporary/elevated access also, where access can be granted for a specific period and automatically removed after the approved duration.

Similarly, how does the offboarding process work through the app? Can it automatically revoke application access, remove group memberships, and complete the required deprovisioning steps based on an approved JSM request?

Thanks!