Claim domain accounts, exclude from Guard

Question

Hi,

I'm going through the process of setting up SAML SSO for our Atlassian/JIRA suite, part of which is claiming users for our domain. I can't figure out how to exclude claimed users from an Atlassian Guard license, is this at all possible?

It seems that unlike other standard apps (JIRA, Confluence) I'm unable to restrict access to it. There's no context menu. We've only got 25 licenses, but 93 users to claim (mostly non-enterprise Trello) that we don't want to pay for.

Thanks

Hari Krishna · Accepted Answer

Hi @Laurence Oldfield ,

You can avoid unnecessary Atlassian Guard license usage by limiting SCIM provisioning from your identity provider.

In your IdP (like Okta or Azure AD), create a group for only the users who need SSO (like Jira or Confluence users). Then configure SCIM to sync only this group to Atlassian Access.

This way, even if you've claimed the domain, users outside the synced group (like Trello-only users) won't be provisioned and won’t consume a Guard license. Also, make sure they don’t have any product access assigned in Atlassian Admin.

This setup allows you to keep using SSO and security policies for the required users while staying within your license limits.

Utkarsh Agarwal · Accepted Answer

Hi @Laurence Oldfield

Welcome to the community!

With an Atlassian Guard subscription, you can create a non-billable policy when you don’t want to pay for certain users.

Refer: https://support.atlassian.com/security-and-access-policies/docs/what-is-a-non-billable-policy/

Kind Regards
Utkarsh