Welcome to the Early Access Program (EAP) for SCIM-synced Atlassian Teams - share your feedback here

[#1]

Hi everyone,

We're excited to have you on board as one of the first users to try our SCIM-sync Atlassian Teams experience. 

I'm starting this thread for you to post your feedback and thoughts on the feature.

Here's everything you need to know and can expect while participating in the EAP over the next few weeks. 

Quick note that the below experience may be different if your organization has original user management. Please refer to this post on how to use the feature if this applies to you. 

Not sure which experience you have? Follow this page to identify whether you have centralized user management or original user management.

What's new and what's changed?

In AdminHub, connect your Atlassian Teams to SCIM-synced Groups.

---

SCIM-synced Groups will show the Team they're connected to.

---

SCIM-synced Teams have their own team profile, the Teams are read-only and cannot be edited.

When will I see this new experience in my organization?

• The EAP kick off October 7th, 2024 and will run for around 3 months. 
• We plan to slowly roll this new experience to EAP participants from this date, so please note, it may take a few extra days for the change to be available in your organization.
• Some of you may have been told you'll receive the experience October 7th, 2024. However, in a recent screener, we've found that a proportion of you have non-vortex, which isn't support yet, but will be supported around November. I have emailed you if this applied to you.

You will see the changes in Atlassian Admin - only organization admins will be able to view and connect Teams here. All end users will be able to see usage of the SCIM-synced Teams across our product experiences. 

What else do we plan to introduce during this EAP?

Some other additions planned for during this EAP will include:

- Ability to connect your Atlassian Teams to local Groups (non-SCIM-synced Groups)

- Ability to connect your Groups to existing Teams

Can I switch this experience on and off?

This experience is applied at an organization level. This means all users in your organization can see the same changes. 

If you wish to turn this off, please reach out to us at achi@atlassian.com and we will revert Atlassian Admin back to their original state without SCIM-synced Teams.

What feedback are we looking for?

We’d love to hear your feedback, particularly on these aspects of the new experience:

• Understandability - how easy is it to understand what’s changed?

• Usability - how easy it is to use this new feature?

• Functionality - how well does this feature’s capabilities meet your needs?

How do I ask questions and give feedback?

You can use this private group to:

• post questions
• raise bugs
• discuss features
• provide feedback

Watch this group as we'll keep you posted on latest details of the EAP and key changes. Please feel free to also extend this invitation to other org admins in your organization if they'd like to contribute. 

[Rudy Holtkamp]

Hi @April Chi ,

Will this be a one-way sync? From user group to team? 
Of is it possible to do a two-way sync (with none public teams). 

Another Q: Currently you can share filters, dashboard, board with groups, it would be awesome to also be able to share it with teams.

[Dan W]

Can the synced teams use the JSM integrated Operations functionality?  

[Chris Rainey]

What does non-vortex mean?

[April Chi]

Hey @Rudy Holtkamp ,

Will this be a one-way sync? From user group to team? 
Of is it possible to do a two-way sync (with none public teams). 

When you refer to public Teams, are you referring to 'open teams'? i.e. Teams where anyone can join?

It's a two way sync i.e. if you connect a Group to a Team, the Team is connected to the Group. However, the source of truth will be the Group i.e. you will only be able to manage the membership via the Group, this will be reflected in the Team after the change. You can't change membership on the Team side as it will be locked down. 

Another Q: Currently you can share filters, dashboard, board with groups, it would be awesome to also be able to share it with teams.

Thanks for the suggestion, will keep this in mind! So I can get more context, what do you use Groups for and what do you use Teams for? 

[April Chi]

Hey @Dan W ,

Can the synced teams use the JSM integrated Operations functionality?  

Were you initially from Opsgenie and now you're migrating to JSM? Yes, these SCIM-synced Teams can be used anywhere as long as the org admin is able connect a Group to it. 

[April Chi]

Hey @Chris Rainey , 

What does non-vortex mean?

Apologies, non-vortex refers to 'original user management', there's  page on it here where user and group management is in the site level. The alternative is 'centralised user management' documented here and here where the user and group management is in the org level.

Hope this helps and let me know if you have any further questions!

[Rudy Holtkamp]

Hey @April Chi ,

Thanks for your reply

> It's a two way sync...

Ok, by my definition this is a one way sync. I can only manage it on the user group side. (Which is fine, I just want it to be clear.)

>So I can get more context, what do you use Groups for and what do you use Teams for? 

I've several customers that do not use 'Jira projects' as their daily driver, but only 'Team boards; which means that de underlying filter is merely based on the Teams field. Issues (or should whatever we need to call them these days) are assigned to a team. It will will show on their board so they can divide the work amongst team members (or hand-it over to another team).
Since the also use filters and dashboards, it would be very convenient to be able to share these (and boards) with Teams. 

[Nico Maikranz]

Hi,

If I create and link a team via a group, is the team name always the same as the group name, or can the team name be edited on creation for example?

[April Chi]

Hey @Nico Maikranz ,

Thanks for the question!

If I create and link a team via a group, is the team name always the same as the group name, or can the team name be edited on creation for example?

The team name is the same as the group name on creation. It can't be edited at the moment. 

Let me know your use case if this is something you think would be useful and I can share the feedback with my team :) 

[Alejandro Cortina]

Is Google Workspaces supported?

Which are the SCIM sources supported?

[Nico Maikranz]

Hi @April Chi ,

My usecase would be as follows:

We currently synchronize groups with Microsoft Azure.
Our company organization is mapped within the Active Directory with organization groups.

Here are a few examples:

ORG-DE-FD-IT-ISS-CS -> Team Customer Service
ORG-DE-FD-IT-ISS-DCS -> Team Data Center Services

If I now create a team from the group, the name of the team is not really meaningful or does not reflect the name of the team.

The team names in Jira should only be Customer Service and Data Center Services

It would therefore be nice if the name of the team could be adapted when it is created and there is still a relationship between the team and the group.

Best regards

Nico

[Kevin Pfaffhauser]

same as @Alejandro Cortina — curious to hear whether Google Workspace is supported here as its current implementation doesn't seem to support SCIM but it can sync the groups through API (in which case you'd lose SAML SSO though - I remember nightmares from the past).

A list of generally supported Identity Providers can be found here however there's no indication as to which ones do provide SCIM and to what level. That GWS doesn't support SCIM-provisoned groups can be found in the Google Workspace Doc, Google Cloud Doc (this is Google Workspace as well, docs should be consolidated and made clear that one integration is with SAML, one with OAuth). A corresponding Feature Request for GWS SCIM group-sync can be found as well.

I found it's at least the following IdP should work for the EAP (tbc) and for the non-mentioned ones you'd have to wait to later in the EAP (Ability to connect your Atlassian Teams to local groups that are non-SCIM-synced Groups; Ability to connect your Groups to existing Teams).

• Okta
• Entra ID (formerly Azure AD, please update doc with search&replace)
• JumpCloud
• onelogin

💡 As feedback it would probably also help in the form to ask for the main IdP used at the organization with a drop-down of the supported providers, and "Other".

@Nico Maikranz from the screenshots it seems that it creates the same name however I cannot confirm yet. Would definitely be nice to be able to have a different name than the group.

[April Chi]

Hey @Kevin Pfaffhauser ,

Thanks for the message and appreciate the feedback/question! Our feature connects Atlassian Teams to SCIM-synced Groups. Google Workspace should be supported but let me forward your feedback and get back to you after some investigation.

In the meantime, let me know if you have any further questions!

Regards,

April

[Ronny Katzenberger]

Thanks @April Chi .

I have two questions:

1. Can SCIM-synced teams be differentiated from regular teams via JQL?
   I would like to filter for managed teams in a Tempo Structure view for example, or in JIRA Plan so that only related items for managed teams are shown versus having all other teams show up as well.
2. I'm assuming admins have a choice of what SCIM groups to sync to teams and not all groups are automatically synced? (I have not seen the experience yet - it will be enabled for us tomorrow. So maybe this is a silly question)

[April Chi]

Hey @Kevin Pfaffhauser ,

Getting back to you, thanks for your patience. I've confirmed that Google Workspace is supported and if your Group is synced to an externally managed group in Google Workspace, you should be able to connect it to a Team. What kind of problems are you encountering?

Also let me know if calling would be easier, happy to help.

Regards,

April

[April Chi]

Hey @Ronny Katzenberger ,

Thanks for your question!

Can SCIM-synced teams be differentiated from regular teams via JQL?
I would like to filter for managed teams in a Tempo Structure view for example, or in JIRA Plan so that only related items for managed teams are shown versus having all other teams show up as well.

Not at the moment, no. I'll share this with my Team and investigate it.

re; Managed Teams, how is it going to be different from other Teams that aren't managed? i.e. are you filtering it because these are 'official' Teams that can be connected to work as opposed to the other Teams? 

I'm assuming admins have a choice of what SCIM groups to sync to teams and not all groups are automatically synced? (I have not seen the experience yet - it will be enabled for us tomorrow. So maybe this is a silly question)

That's correct! You will be able to decide which Teams you want to sync. They will not be automatically synced. 

[Ronny Katzenberger]

@April Chi 

re; Managed Teams, how is it going to be different from other Teams that aren't managed? i.e. are you filtering it because these are 'official' Teams that can be connected to work as opposed to the other Teams? 

Yes, because they would be official teams as part of or organizational structure (org chart). We are maintaining a central roadmap (One Roadmap for the whole company) via Tempo Structure and would like to make it match our organizational structure. This makes our roadmap very discoverable and aligns with our employees' understanding of where they are within the company or the part of the roadmap they would like to explore (e.g., another team or division for tracking dependencies etc.). Without the managed team capability (or SCIM-synced teams), we were forced to manually maintain a list of our "official" teams via a custom field.   

I hope this helps!
I'm happy to chat more in person.

[Darryl Lee]

A few questions:

• Is this compatible with Azure AD for nested groups?

  • If we've switched from SCIM to Azure AD for nested groups, is this functionality unavailable to us?
• Does this synchronization allow us to BLOCK users from creating their own teams? Or at least teams with the same name (which is inexplicably currently allowed?)
• Are non-vortex orgs supported yet?

[Kevin Pfaffhauser]

@April Chi unfortunately I'm unable to test it yet as we're still on the EAP waitlist plus we'd use one of the for groups SCIM-supported IdP (not GWS). Very keen to have this implemented across our company though!

[Rune Rasmussen]

I have now created our first team linked to a SCIM synced group.
Our groups follow a naming syntax of app_[system/service]-[function]-[function].....
Example: app_AtlassianCloud-admins or app_JiraServiceManagement-TheProject-ReadOnly.

Having an editable "Display Name" for these teams would very much be a must-have for us.

[April Chi]

Hey @Kevin Pfaffhauser ,

Thank you again for your interest in the EAP. We're ready to turn it on your organization now, most likely this week onwards. I've emailed you about it and will keep you updated there. 

Thanks again for your patience and once again, thank you for taking part in this EAP 🙏

Regards,

April

[April Chi]

Hi @Rune Rasmussen ,

I have now created our first team linked to a SCIM synced group.
Our groups follow a naming syntax of app_[system/service]-[function]-[function].....
Example: app_AtlassianCloud-admins or app_JiraServiceManagement-TheProject-ReadOnly.

Having an editable "Display Name" for these teams would very much be a must-have for us.

Appreciate the feedback! We're currently prioritising this. Can you please share some insights into your use case. In your opinion, who should be able to edit this team name? 

Should it only be the org admin or members of team too?

Look forward to your response!

[Rune Rasmussen]

@April Chi 

Appreciate the feedback! We're currently prioritising this. Can you please share some insights into your use case. In your opinion, who should be able to edit this team name? 

Should it only be the org admin or members of team too?

Ideally I would like to be able to set a Team manager/owner/lead who could have the elevated permissions.

Knowing my users and colleagues, they are going to bitch and moan ad infinitum if I tell them they have to submit a ticket every time they want to update the name of a team.
And my fellow Atlassian admins may just lynch me if I tell them we have to spend our time updating team names.

On the other hand, just letting every user change the name of every group seems like a shortcut to mistakes and unintended actions.

As a side note, I think this EAP is a very good addition to the Teams feature, but I would like to see Teams be built out even further.
There are feature requests to add options for managing who can create and/or delete Teams, which would go very nice with this sync functionality.

[Jared Schmitt]

Before joining the EAP we'd like to know a few things:

1. Can we connect a non-SCIM group to a Team?
2. Can a connected Team automatically be renamed once the underlying group gets renamed?
3. Can we stop users from creating their custom Teams?
4. What happens after the ~3months of the EAP? Will functionality stay in the Org? Will it revert back?

[Pier-Olivier Tremblay]

Looks like we lost some of the features today. Is this expected ?