According to the documentation in user provisioning, you can manage groups and provisioning by groups after connecting to an identity provider. However, what happens to existing groups and group membership when converting to an identity provider?
Hi Zane,
It depends on how you set it up. You do not have to have all groups connected to your identity provider. Actually, I would just only one or two, depending on the need. When you connect the group to the provider, though, it will lock it in Jira and can only be updated by the provider.
Hey John, thanks for responding. I have spent time testing this and I agree with you it is easier to manage syncing just a few groups through the identity provider. I have also confirmed that existing groups and membership is not affected as long as those groups are synced across.
Question: as the group is locked because it can only be updated by the provider, when I try to make it the DEFAULT ACCESS GROUP for Jira software I get this error. What is the implications of this? What should be the default access group then?
@John Funk another question for you above.
Hey Jill - the default groups are the groups that will automatically be given to the user when their account is setup. If you have a separate group connected to your ID provider (AD, Okta, etc.) then by definition the user will be placed in this group. So you don't need to set it as a default group.
But I would also grant access to the product to this ID provider established group just to avoid any connection issues for the user.
It looks like you're new here. Sign in or register to get started.
