migrate local users to Azure+scim

[of7085]

Hi all,

currently about 2,000 of our members (of our domain) have existing accounts with Atlassian. The domain has been claimed, those accounts are visible as "local", I can manage them locally (e.g. disble and delete former members).

I connected Access to Azure for SAML and SCIM. My domain has been connected to the identity povider.

I can successfully create NEW users and groups using Azure+SCIM.

However, I would like to manage existing accounts using SCIM, which fails. The username could be easily linked to Azure, but using SCIM manually I can verify that only 10 of my 2,000 users are visible via SCIM. Those are the accounts that have been created usind SCIM in the first place.

How can I transfer accounts from local to Azure-management? I expect Azure to automatically link them, once they are visible using SCIM.

Best regards
Patrick

[Craig Castle-Mead]

Hi @of7085 

Based on your description, I assume you have the below in Access:

• A local authentication policy that contains all of the users who you claimed/added before you setup your AzureAD connection in Access
• An SSO authentication policy that contains all of the users you’ve provisioned in AzureAD since the connection was established

If that’s the case, and all users in the local policy have the same usernames as would come from AzureAD, I’d expect the below to work (validate with a small sample of low impact users first):

• Ensure users in the local policy are added to AzureAD in the way you’d add them if they were net new users
• In Access, move the users from the local authentication policy to the AzureAD auth policy. This should then create a SCIM connection between the user and AzureAD object.

CCM