Entra ID automation “Add user to group” fails for Group - consent error but permissions look granted

[Xijie Yi]

Hi everyone,

I’m testing Jira Cloud Automation actions with Microsoft Entra ID, following the Atlassian doc Use Entra ID with Automation | Cloud automation Cloud | Atlassian Support The “Check if user is in group in Entra ID” action works, but “Add user to group in Entra ID” fails consistently.

In Automation audit log, the “Add user to group in Entra ID” step fails with: “User consent is required for this component.” 

I checked the Atlassian enterprise app in Entra shows Graph permissions including GroupMember.ReadWrite.All and it’s granted via Admin consent. 

Any help would be appreciated. Thanks!

[Zänkert_ Moritz]

I was able to get this working successfully, but only after a few important adjustments on the Entra ID side.

In my case, the user account that is configured under “Connected to Entra ID” in the automation rule needed to have the required Entra permissions assigned permanently. The application permissions alone were not sufficient, and using PIM‑activated roles did not work for automation calls – the group write actions kept failing as long as the roles were only eligible/activated via PIM.

What finally worked was assigning the following Entra roles as permanently active roles to the service account:

• User Administrator
• Groups Administrator

After that, the automation was able to add users to Entra groups without any issues.

Another detail: I could only make the rule work when using the group ID as the Group identifier type. Using the group name consistently failed in my setup.

Maybe this helps others running into the same problem

[Marc -Devoteam-]

Hi @Xijie Yi 

Have you gone over all prerequisites on both Jira and MS side?

Are all permissions set correctly and has the user executing the automation also the correct permissions?

[Tomislav Tobijas]

I've been trying to find the time to test this integration, but it wasn't a priority, so I didn't have a chance yet 👀

Based on the documentation you've also linked, what you could do is:

• Double-check that the Atlassian app in Entra ID has all required permissions
• If you have only granted admin consent, try having a user (with sufficient privileges) log in and explicitly grant consent for the app (like some other Jira and Entra admin)

There's also an official article: Third-party applications that connect to Automation, which ultimately directs you to the article you've mentioned. 

I do manage parts of Entra that are related to Atlassian in our environment, but I've never go in details when it comes to Microsoft Graph 🤔