nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Assign App Access to SCIM synced groups

spencmax

I'm using SCIM to provision users and groups to my Identity Provider (with verified domain) in Atlassian. I'd like to grant app access to the synced groups, but I'm not seeing any way to do that. Is this possible?

Navigating to Security -> Identity Providers -> <my_idp> -> View Groups, I can see the groups I synced over for testing, but see no way to assign app access to them. Delete is the only option.

Screenshot 2025-05-27 at 6.05.22 PM.png

If I go to Directory -> Groups, the synced groups are not shown there, so from this view I'm only able to add app access to non-synced groups

Screenshot 2025-05-27 at 6.06.43 PM.png

I also thought the Apps page might allow what I'm attempting, but that doesn't work either. Only non-synced groups show in the dropdown when adding a group to an app. Using my Bitbucket app as an example and clicking `Add Groups`:

Screenshot 2025-05-27 at 6.11.00 PM.png

How can I add group access to my IdP synced groups (e.g. 'another atlassian group') in the same way I'm able to add them to non-synced groups?

Accepted answers

spencmax

After reaching out to support, this was confirmed to be an existing, known bug. Groups created via the SCIM API will not display on the Directory -> Groups page nor the 'Add groups' dropdown for apps if all apps in the organization are "siteless."

The workarounds are:

Add at least one sited product (E.g. Jira Software, Statuspage), or
Contact Atlassian Support to enable SCIM for a siteless organization

In my case, I initially only had Bitbucket (siteless). I added Statuspage and then SCIM-created groups began appearing in all the expected places.

All comments

Kieren _SmolSoftware__ar1cj1

Hi @spencmax

From what I can see, it looks like you're doing all the right things. The SCIM groups should show up in your Groups list, and they should be available to add to your apps.

Can you look at the Identity Provider status page and tell us what you see? Here's an example of mine. Do the logs indicate that a successful sync has already occurred?

Screenshot 2025-05-28 at 11.24.53 am.png

spencmax

Hi, Kieren!

Thanks for the response! A screenshot of my identity provider page is below. A couple additional details I should have mentioned prior, just in case they're relevant:

I'm currently on a trial of Atlassian Guard
I'm provisioning users and groups using the SCIM API directly: https://developer.atlassian.com/cloud/admin/user-provisioning/rest/intro/#about
Because of ^that, I'm not using any "officially supported" integration like Google, Azure, or Okta. When adding the identity provider, I chose type "Other provider"

More notably, it seems like provisioning works a bit different in my setup than what's in your screenshot. Yours has text stating "Users sync every 4 hours," which implies a "pull" from Google to Atlassian, initiated by Atlassian. In my case, there is no scheduled sync, but rather my app pushes updates to Atlassian on-demand, and there is no scheduled sync time. I'm not sure if any of that makes a difference to expected behavior in the UI.

Note: the error count shown for provisioning in the IdP screenshot page can be ignored. That's expected due to me testing various scenarios with my application's API calls.

Screenshot 2025-05-27 at 8.45.11 PM.png

Screenshot 2025-05-27 at 8.43.24 PM.png

spencmax

I should add, regarding my statement:

Yours has text stating "Users sync every 4 hours," which implies a "pull" from Google to Atlassian, initiated by Atlassian.

this is just a guess on my part. Looking at Google's documentation for the integration, it does seem they push updates to Atlassian on-demand as well.