Azure AD Default Groups

Gary Williams_98gzyl

Hi all,

New to the community and JSM, couple of hoping quick questions as can't work out a solution here ...

1. How does the "All users from Azure AD" get built, is this derived from from all the unique users in selected sync groups?

2. If we set up the default group names in Azure AD to sync i.e. "jira-servicemanagement-customers-xxxxxxxx" they are not updating in Atlassian, is there any reason for this?

 

Regards,

Gary

Kieren _SmolSoftware_

Hi @Gary Williams 

1. Yes, this is a unique group that is created the first time you sync your IdP. It has the unique set of all the users you're syncing to the Atlassian directory.

2. This has been an issue for a while and unfortunately there is no feature within admin.atlassian.com that will allow you to sync an IdP group to a default group. It's a huge pain point for Atlassian Admins who want to utilise the default or custom Atlassian groups for both SCIM and non-SCIM sync'd users.

The reason you cannot sync to the default groups, is the Invite and product access features in Atlassian Admin rely on the default groups to be able to grant users access to products. When a group is being sync'd to, it becomes read only in the Atlassian Admin UI, so admins can no longer invite and control product access via those default groups.

There are two ways to get around this:

1. There is an upcoming app we're building that will solve this, essentially we're solving ACCESS-604. It's about to be released in a free closed beta, if you're interested contact us via our website smolsoftware.com to be a part of the beta.

2. Create a new group called New-JSM-Customers-Default, make that group the default product access group for JSM. Remove the default group setting from jira-servicemanagement-customers-<sitename> and then you can sync to your old default group (jira-servicemanagement-customers-<sitename>) and it will retain your in product JSM security settings. This is a complex way to go about it, and means that users who get invited vs sync'd will be in different groups and require the same security settings to be created in JSM for the new group New-JSM-Customers-Default.

Hope that helps.

-Kieren
Co-Founder @ Smol Software | Ex-Atlassian