Nested groups flattening with Azure AD sync – Early Access Program / General Announcement

[#1]

Hi Atlassian Community,

---

UPDATE June 2023:

I’m excited to announce the general availability of Microsoft Azure Active Directory (AD) for nested groups. The early access program (EAP) for Azure AD sync is finished.

Here's the General Announcement community blogpost: 

https://community.atlassian.com/t5/Enterprise-articles/Azure-AD-for-nested-groups-is-now-generally-available/ba-p/2391051 

---

I’m Ben, a Product Manager on the Cloud Migrations team.

I’m excited to share that we’ve just started an Early Access Program (EAP) for Azure AD sync, which is an integration between Microsoft Azure Active Directory (Azure AD) and Atlassian Cloud that supports nested groups flattening.

Over the past few years, we’ve seen requests to add support for nested groups in Atlassian Cloud. Although nested groups aren’t supported and we don’t plan to support them in the nearest future, you can keep the nested structure in your external user directory and use the flattened structure in Atlassian Cloud.

We believe that a flattened structure lets you manage permissions and your organisational structure in a similar way to our Server and Data Center products. You can achieve such a structure by using an identity provider or syncing method that supports flattening.

How flattening works

We’ve published an article that explains how flattening works and how to best approach nested groups when moving to Cloud. For details, see Prepare nested groups for Cloud migration.

To give you an example, this is how a flattened structure could look in Atlassian Cloud. As you can see, although groups are no longer nested within one another, all effective memberships are kept:

Supported IdPs and nested groups flattening

Here’s a summary of how identity providers supported in Atlassian Cloud approach nested groups and flattening:

Identity provider	How it works	Details and related links
Okta	These identity providers flatten nested groups when you import them from your user directory You then connect any of them to Atlassian Cloud over SCIM and sync the flat structure	Okta documentation on nested groups Connect Okta to Atlassian Cloud
PingFederate		Connect PingFederate to Atlassian Cloud
OneLogin		Connect OneLogin to Atlassian Cloud
Microsoft Azure Active Directory (Azure AD)	Atlassian created a custom integration for syncing users from Azure AD to Atlassian Cloud The nested structure is flattened while syncing You can’t flatten nested groups when connecting to Azure AD over SCIM	General Announcement coming soon
G Suite	G Suite supports nested groups When syncing to Atlassian Cloud, you must select every group (parent and nested) separately in the sync settings. These groups will be synced as a flat structure. Any group that isn’t selected won’t be synced and users will lose memberships in it.	Provision and sync users from G Suite

More on Azure AD sync

If you use Microsoft Azure Active Directory and nested groups, you’ll need to use Azure AD sync to flatten and sync them to Atlassian Cloud. Flattening isn’t supported when connecting to Azure AD over SCIM. 

What’s included in the EAP/GA:

• Automatic syncing of users and groups from Azure AD to Atlassian Cloud

• Flattening of nested groups on the way to Atlassian Cloud, with all effective group memberships preserved

• Group filtering, automatic domain claim, authentication policies, single sign-on for synced users

If you already provision users from Azure Active Directory over SCIM, you will need to disable SCIM and switch to AzureAD sync. When having larger amount of groups, it takes time until we completely disable SCIM on our side - you can read more here. We’re working on solving this issue.

[Jack Brickey]

Nice article @Ben Borecki . While it isn't immediately applicable to me I enjoyed it just the same. Thanks for sharing.

[Masayuki Abe]

@Ben Borecki 

If I switch to Azure AD Sync, will the group name changes in Azure AD be synced to the Atlassian Cloud side?

[Ben Borecki]

@Masayuki Abe unfortunately we don't support group renaming in Azure AD sync - group name changes in AzureAD won't be reflected in Atlassian cloud. 

[Masayuki Abe]

@Ben Borecki I will wait for another feature request release

[Mark Holmes _Adaptavist_]

@Ben Borecki I am working on my first Could Migration from DC for Jira and we have to deal with Azure AD and Nested Groups. I'd love to explore the EAP. I'll email you.

[Ben Borecki]

@Mark Holmes _Adaptavist_ we'd be happy to onboard you to the EAP! 

[Ilango A]

Hello @Ben Borecki , this is a great feature that we are looking forward to. Do you have an ETA for the public release please?

Cheers!

[Ben Borecki]

Hey @Ilango A we plan to have the public release around June/July 2023! We're going to update this blogpost right after general announcement. Stay tuned!

[Klaus Floth]

Hi @Ben Borecki, we are really looking forward to this feature in the Atlassian cloud, which we were already used to in the server variant. I learned if we'd like to join the EAP we'd have to switch from SCIM to Azure AD sync. However, our IT department does not want to use an unreleased and unsupported feature productively. How does it work when nested groups flattening is publicly released? Do we still have to switch from SCIM to Azure AD sync to use this feature then or will it be available with SCIM?

[Ben Borecki]

Hi @Klaus Floth the public release is now in progress, we should roll-out the changes to all customers by the end of June/early July. Nested groups flattening won't be supported in AzureAD SCIM, so you will have to switch to AzureAD.

[Ben Borecki]

Hi @Klaus FlothAzureAD sync was just released to public. You can find the documentation explaining how to switch from SCIM to Azure AD sync here: https://confluence.atlassian.com/enterprise/switch-from-scim-to-azure-ad-sync-1141966053.html

[Klaus Floth]

Hi @Ben Borecki, we tested Azure AD Sync with nested groups plattening support today but we found out that we either can synchronize all Azure AD groups (which does not suit us at all, because synchronising all groups would firstly make the group list in Atlassian Access very confusing, as we only need a fraction of the groups here, and secondly the synchronisation would take a very long time due to the number of groups in our AD) or only explicitely spezified ones, but it seem not to be possible to sync groups fitting to some kind of regex. E.g. if we have a couple of groups with names starting with "SW_Atlassian_" we can't configure groups synchronization with wildcards like "SW_Atlassian_*". This would mean that we would always have to explicitly include every newly created group that we need in Atlassian Access in the list of groups to be synchronised. Is this correct or did we overlook something?

[Ben Borecki]

@Klaus Floth 

>  it seem not to be possible to sync groups fitting to some kind of regex.

Thanks for the feedback. You're right - that option doesn't exist right now. If you find that option useful, you can create a JAC ticket so we can start gathering interest. Similar to the https://jira.atlassian.com/browse/ACCESS-1426 issue.

> E.g. if we have a couple of groups with names starting with "SW_Atlassian_" we can't configure groups synchronization with wildcards like "SW_Atlassian_*". This would mean that we would always have to explicitly include every newly created group that we need in Atlassian Access in the list of groups to be synchronised. Is this correct or did we overlook something?

It would be best to reach out Atlassian support team, so they can help with figuring out the best workaround. However, what I can suggest from top of my mind is creating a parent group "SW_Atlassian" and adding all "SW_Atlassian_*" groups there. It's still manual though. 

[Fabian Krehnke]

Cheers @Ben Borecki

For which license is it available? 
Was it rolled out for all those who have licensed Access or is an Enterprise license required? 

[Ben Borecki]

Hi @Fabian Krehnke , AzureAD sync is available to any customer that has Atlassian Access.