Add all internal users to directory to access only JSM as customer

[Ramon Gamma]

A organisation licensed Jira, Confluence, JSM, Guard in the cloud for ~1000 users.
The user provision is coming from internal AD and the users are login via SSO. The rest of the organisation (Total ~3000) should be able to access the JSM portal as customer only and login via SSO.

Our idea is to add all the internal users to the Atlassian directory with user provisioning and add them to a group which is having access to JSM as customer.
So all internal users are able to login via SSO to access JSM customer portal.

At the moment we're facing the problem that only the users which are having product access for eg. Jira are showing up in the directory of Atlassian.

We are wondering if users which are not in a group for a paid product (eg. Jira user) are not added/displayed in the directory by Atlassian.
Maybe there is such a limitation for which we are not able to find the documentation.

[Neil Fletcher · Accepted solution]

Hi @Ramon Gamma 

I have a similar setup.  The group is created in Azure AD named: <company>_All_Employees
Whenever anyone joins/leaves, they are added/removed from the group.

I'm using the AAD User Principal Name to sync, so we capture all employees with and without a 365 licence.

The group is sync'd to Atlassian and added to the JSM product as a Customer

Then, the same group is added to the JSM project with Role = Service Desk Customers

It allows all employees to access the portal and submit incidents, request etc

[Ramon Gamma]

Thank you for your answers.

From what I see, we are doing it right and the potential issue as to why it actually doesn't work is probably an internal one.

I will forward this to the stakeholders so it can be analyzed and fixed.

[Mariana Silveira Sales]

@Ramon Gamma 

I don't know if you already check this documentation: https://confluence.atlassian.com/cloudkb/user-provisioning-and-saml-single-sign-on-for-jira-service-management-customers-1333826180.html

but it seems to address this specific configuration.

"The JSM Customer role can be granted during SCIM user provisioning by synchronizing a user group from your external directory or granted when users access the portal using SAML Just-in-Time (JIT) provisioning through configured authentication policies, which will create an Atlassian account at login." 

So when syncing the group into Atlassian Cloud, you'll need to setting it as an access group for the Jira Service Management - Customer application access.