Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

It's not the same without you

Join the community to find out what other Atlassian users are discussing, debating and creating.

Atlassian Community Hero Image Collage

Azure AD SCIM User Provisioning Question

Hello all!

We're migrating our on-prem JIRA and Confluence server instances to Cloud.

While setting up Atlassian Access, upon verification of our domain, I have a bunch of managed accounts present. (great, but not quite what I want long term)

We've set up SAML SSO with O365/Azure AD successfully (cheer). For the couple of test users who've tried it out, this is working as expected. 

I'm now working on SCIM user provisioning (from the same Azure AD to the same Enterprise App as used for SAML).  My questions are with adding scoping filters.  Or - maybe there is some other means besides scoping filters to accomplish the following?

  1. Can I scope to provision users from a specific OU rather than syncing everything from Azure AD into Access? 
    1. If not, and I have to use one of the listed attributes, I'm curious as to which you're using for your envrionments (hoping inspiration strikes from your suggestions)
  2. Same question for group provisioning. We'd like to sync the groups in a specific OU only, and not ALL of them in our AD. 

Thanks in advance for you help and insights!

1 answer

If you configure your Atlassian Cloud Enterprise Application to "Sync only assigned users and groups" (a drop-down in Manage/Provisioning/Edit Provisioning/Settings) it will only sync individual users and users from groups you assigned to the application in Manage/"User and groups".

It will also sync only groups listed there i.e. if you had a user who is a member of 30 groups, but you assigned only 1 group out of these to Atlassian Cloud – only this group will be synced.

This is why it is recommended to have 2 instances of Atlassian Cloud application - one for SSO, where the assigned groups define who are allowed to do SSO into Cloud, and the other for Provisioning, where the assigned groups get synced with the users who belong to them and can be used for more fine-grained permissions inside the Cloud applications.

Obviously you'd want to have all groups set on the SSO-related application to be in the list of groups set on the Provisioning-related application, but possibly not the other way around.

Thanks for the response.  So what I'm hearing is, we need to use groups.  There isn't a means to pull from an OU (because the traditional OU structure doesn't exist in Azure AD). 

I appreciate the support for the recommendation to use a second app instance.  Now to figure out how to remove the provisioning from the SSO app.

Suggest an answer

Log in or Sign up to answer
Community showcase
Published in Atlassian Access

Resources + Q&A from "What's new in Atlassian Access" webinar

Hi Community! Thank you to all those who joined our What’s new in Atlassian Access webinar last week! We received so many great questions about existing functionality and newly released features of...

996 views 2 8
Read article

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you