nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

SCIM vs Graph API (Azure AD for nested groups)

Adam Rypel _MoroSystems_

Hi all,

We are in the midst of our cloud project and I am thinking how to specifically handle the user management.

The user provisioning goes through Azure AD and Atlassian Access, that is clear. However, with the recent release of Azure AD for nested groups, I am deciding which option to use - regular SCIM or Azure AD for nested groups? Even if the customer does not use the nested groups, the "Azure AD for nested groups" seems easier, quicker to configure, is managed from Atlassian side and at the same time offers the same functionality. Is there a reason to still use SCIM?

So basically my question summarized: Does Azure AD for nested groups (Graph API) have any limitations compared to SCIM way?

Thanks,
Adam

Accepted answers

All comments

Kyle Lapham

Hi @Adam Rypel _MoroSystems_

Did you get anymore knowledge on this?

The documentation seems short on the limitations and i am pretty much trying to understand these.

Let me know if you have found out any information on this please.

Thanks

Kyle

Adam Rypel _MoroSystems_

Hello @Kyle Lapham ,

Not much, our customer eventually decided to use SCIM anyways due to the security reasons (they don't want to use API), so it was a clear decision.

I summarized just couple of points at the time:

SCIM

does not allow synchronization of nested groups
allows you to create custom attribute mappings
requires application installation in Azure AD
it is managed and configured in Azure AD

Graph API (Azure AD for nested groups)

enables the synchronization of nested groups
does not allow you to create custom attribute mappings
it works through a technical account that must have admin rights in Azure AD - through this account data is pulled using the API
it is managed and configured from the Atlassian administration

I was testing it during EAP and it seems the only limitation is the inability of creating a custom mapping - so you cannot choose which attribute goes where and adding any additional attributes.

If I remember correctly, the Graph API option also has a synchronization interval every 4 hours, opposed to SCIM's 30-60 minutes.

Hopefully that helps you a little bit.

Adam

Kyle Lapham

Very Helpful, appreciate your quick response on this Adam

Lennert Timmers

@Adam Rypel _MoroSystems_ in your summary about the Azure Graph API you mention the use of a technical account. Do you know if there is more documentation about the use of this account and the exact permissions needed (like scopes or app roles)?

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira

cloud

sso

atlassian-guard

azure

active-directory

user-management

identity-manager

scim