Come for the products,
stay for the community

The Atlassian Community can help you and your team get more value out of Atlassian products and practices.

Atlassian Community about banner
Community Members
Community Events
Community Groups

Azure AD SCIM User Provisioning Question

Hello all!

We're migrating our on-prem JIRA and Confluence server instances to Cloud.

While setting up Atlassian Access, upon verification of our domain, I have a bunch of managed accounts present. (great, but not quite what I want long term)

We've set up SAML SSO with O365/Azure AD successfully (cheer). For the couple of test users who've tried it out, this is working as expected. 

I'm now working on SCIM user provisioning (from the same Azure AD to the same Enterprise App as used for SAML).  My questions are with adding scoping filters.  Or - maybe there is some other means besides scoping filters to accomplish the following?

  1. Can I scope to provision users from a specific OU rather than syncing everything from Azure AD into Access? 
    1. If not, and I have to use one of the listed attributes, I'm curious as to which you're using for your envrionments (hoping inspiration strikes from your suggestions)
  2. Same question for group provisioning. We'd like to sync the groups in a specific OU only, and not ALL of them in our AD. 

Thanks in advance for you help and insights!

1 answer

If you configure your Atlassian Cloud Enterprise Application to "Sync only assigned users and groups" (a drop-down in Manage/Provisioning/Edit Provisioning/Settings) it will only sync individual users and users from groups you assigned to the application in Manage/"User and groups".

It will also sync only groups listed there i.e. if you had a user who is a member of 30 groups, but you assigned only 1 group out of these to Atlassian Cloud – only this group will be synced.

This is why it is recommended to have 2 instances of Atlassian Cloud application - one for SSO, where the assigned groups define who are allowed to do SSO into Cloud, and the other for Provisioning, where the assigned groups get synced with the users who belong to them and can be used for more fine-grained permissions inside the Cloud applications.

Obviously you'd want to have all groups set on the SSO-related application to be in the list of groups set on the Provisioning-related application, but possibly not the other way around.

Thanks for the response.  So what I'm hearing is, we need to use groups.  There isn't a means to pull from an OU (because the traditional OU structure doesn't exist in Azure AD). 

I appreciate the support for the recommendation to use a second app instance.  Now to figure out how to remove the provisioning from the SSO app.

Suggest an answer

Log in or Sign up to answer
Community showcase
Published in Atlassian Access

Atlassian Access Demo Q&A Recap

Hi Community! Thank you to all who joined our ongoing monthly Atlassian Access demo! We have an engaging group of attendees who asked many great questions. I’ll share a recap of frequently ask...

1,153 views 4 4
Read article

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you