Azure AD SCIM User Provisioning Question

[Jennifer Osborn]

Hello all!

We're migrating our on-prem JIRA and Confluence server instances to Cloud.

While setting up Atlassian Access, upon verification of our domain, I have a bunch of managed accounts present. (great, but not quite what I want long term)

We've set up SAML SSO with O365/Azure AD successfully (cheer). For the couple of test users who've tried it out, this is working as expected. 

I'm now working on SCIM user provisioning (from the same Azure AD to the same Enterprise App as used for SAML).  My questions are with adding scoping filters.  Or - maybe there is some other means besides scoping filters to accomplish the following?

1. Can I scope to provision users from a specific OU rather than syncing everything from Azure AD into Access? 
   1. If not, and I have to use one of the listed attributes, I'm curious as to which you're using for your envrionments (hoping inspiration strikes from your suggestions)
2. Same question for group provisioning. We'd like to sync the groups in a specific OU only, and not ALL of them in our AD. 

Thanks in advance for you help and insights!

[Nic Brough -Adaptavist-]

Welcome to the Atlassian Community!

This is what is says it is - your account has no rights to see that page.