User email changes in Azure nor synced to Atlassian Access

[Sérgio Nogueira]

Hi guys

A user in our organization changed name and with that changed the email in our Identity Provider, that generated a new email address which was updated in Azure but not synced to Atlassian Access.
After this the user lost access to Jira and Confluence, since the previous email no longer existed for SSO and could not login with the new email, because it was not registered in Atlassian Access.
The user requested the registration of the new email in Atlassian Access, but still has no access.
Now we have 2 users for the same person not being able to login in Atlassian Access.

How can we solve this sync issue, updating user data in Atlassian Access and granting the needed groups for application access?

[Ed Letifov _TechTime - New Zealand_ · Accepted solution]

Hello, @Sérgio Nogueira 

You should really check the attributes mapping in your Atlassian Cloud application responsible for User Provisioning.

The default values that you get out-of-the-box are not entirely correct. Specifically the matching must be done by objectId, not email, or userPrincipalName – as these, same as first and last names can easily change.

Now that you have two user records for the same user with different emails, you may indeed have to rename the email on one of them – I suspect the new one, so the automatic update can come through on the old record.

[Sérgio Nogueira · Accepted solution]

Hi guys,

this got solved after Atlassian support intervention, otherway I would have to wait for the user delition in Atlassian so that the new user would be synced.

Thanks

[Kurt Rosivatz · Accepted solution]

Hi Sergio,

we sometimes face similar problems with our SCIM based provisioning of users in our Atlassian organization. Synchronization between your directory (Azure AD) and the Atlassian organization itself can take some time. If the users is disable or deleted with his old mail address and then registers himself instead of being provisioned then the his mail address is already "taken" so the changes in your directory cannot be propageted.

Best solution is to contanct Atlassian support - the can usually link the directory user and the newly created.

My workaround is: I rename the self registered user and change his email to something like name.defunct@myorganization.com. As the users is in my organziation I can do that. You must change to a non existing email within your organization. Then I deactivate the user and delete it (deletion is not effective immediately so only deleting is no option). The sync between your Atlassian organization and your directory should than work for your user again. It's very important that the user himself does not login / register with his email in the meantime.

HTH

Kurt