We have set up our Atlassian Access organization and verified our domain. We will be enabling SAML for our identity provider (Azure). I have a question about the User Provisioning process:
It looks like the provisioning process is a separate process after we have made the SAML connection, correct? We have roughly 20,000 accounts in Azure. Will all of those sync over to our Atlassian Access organization, or will we be able to provision subsets of our users by group or organizational unit?
I have the same question regarding groups. Will all groups appear in Atlassian Access? We have thousands. Or do we select groups and push them? I see something in the documentation about pushing a group, but the documentation is rather vague.
I understand that once we have accounts and groups synced, we can provide access to products like Jira Service Desk using the synced groups. Most of our users will be customers only, and about 150 or so users will be licensed for products like Jira, Jira Service Desk, and Confluence.
Can anyone point me to more comprehensive documentation that can help me get an idea of what to expect? I'm trying to avoid creating a mess or sending a "Welcome to Atlassian" email to 20,000 people.
Automatic provisioning of users from Azure AD is not yet supported. It's just been delivered for Okta (another identity provider) and Azure AD is currently under development. Please watch the feature request below to be notified when it's live:
Once it's delivered, you will be able to "push" directories or groups of users.
In the meantime, if you want to proceed with integrating Azure AD before automatic provisioning is delivered, please check the article below, especially the "Just-in-time provisioning with SAML" section in it:
No answer for me. I did learn that there will be an automated message to all of the users once you claim a domain. The notification asks the users to 'connect their account' to the domain that is leading the organization. We still have not completed implementation of SAML. So YES, there will be an automated message.