Assigning default groups or permissions to users from SSO

Question

JIRA Cloud.

So we've integrated with Azure AD using SAML. I've created an AD group for all our JIRA users, and I've granted that group application access in JIRA. Users sync over to JIRA just fine, and they can log in.

The problem is they can't access anything after logging in. I have to manually go add them to the jira-software-users group before they can see any projects, tickets, etc. I can't find any way to either automatically assign the jira-software-users group for these synced users, or to grant my custom AD group the same permissions from jira-software-users. Once they are assigned to jira-software-users, they are able to access everything as I expect (per the in-place permissions of course).

In my searching, the only reference I can find is about the "jira-users" role in the Global permissions section, but I don't see that role in there at all. I'm guessing that was removed since 2015, because I can't find any newer instructions on this.

Does anyone have a way to either:

1. Automatically assign the jira-software-users group to new users synced from SSO?

2. Grant a custom group the permissions necessary to view projects/tickets, in effect making it like the jira-software-users group?

I'm specifically calling out JIRA here, but the same goes for our confluence users.

Mustafa Mansour_oqvth3 · Answer

It's quite surprising that we haven't received an answer or solution for this yet :(

Dave Schultz_iwqfid · Answer

You can assign default access to the site or to the product by way of an externally sync'd group, but you can't (as far as I can tell) grant Global Permissions to an externally sync'd group.  I'm waiting to hear back from support on whether this is possible and how to accomplish it.

admin-nwalter · Answer

Unbelievable that there is still no answer after all this time.