Admin roles and Active Directory (EntraID)

jessica.huebner

I am on Jira Cloud Standard. In Atlassian Admin, I have user provisioning via my identity provider, MS Azure AD (AKA Entra ID). I remembered reading an article that mentioned certain admin roles, specifically  org admins could not be provisioned through user groups, but perhaps I misread/misinterpreted. My question is this: Can I provision the following roles via Azure AD? Any guidance would be appreciated!

• org admins
• site admins
• User access admins
• Billing admins
• Business contacts

Kieren _SmolSoftware_

Hi @jessica_huebner 

Short answer

You cannot provision org admins, site admins, Billing admins or Business contacts directly via your IdP groups. You can for the User access admins.

 

Long Answer

Org and Site admin

The org admin and site admin roles are granted to users via special/protected/fixed groups:

• org-admins
• site-admins

This can be overcome using either the Atlassian APIs to add/remove users to these groups using scripts or a marketplace app, like Admin Automations, to sync users between your IdP groups to the org-admins and site-admins groups.

Note: I work for Smol Software, who creates the Admin Automations app.

User Access Admin

The User access admin roles can be granted to any group, including your IdP groups. You can open a group in admin.atlassian.com and 'Add Product', then select the User Access Admin role for the product you want.

The User Access Admin role does still need to have default groups, similar to other product access groups. e.g. confluence-user-access-admins-smolsoftware, jira-software-user-access-admins-smolsoftware. You cannot change the default group to be an IdP sync'd group.

Billing admin and Business Contacts

The Billing admin and Business Contact role is granted directly to a user via the Billing Console, https://admin.atlassian.com/billing. They cannot be granted via a group and there is no API available for it. 

 

Hope that helps!