Questions: Atlassian Access and Okta for user provisioning

[Gabriel Viger]

Hello everyone,

We are about to activate Atlassian Access and use Okta for user provisioning on our two sites and we have a few questions before we proceed:

1. Is there a prerequisite to have SSO enabled before configuring user provisioning from Okta?
2. Will existing groups and product access linked to those groups be deleted when activating Atlassian Access and user provisioning with Okta?
3. Is it possible to do user provisioning with Okta by assigning users to a group that has no application access? (I have tried by creating a user and assigning it to a group with no product access and this user was automatically redirected to the portal of our JSD instance.)
4. Does any vendors have already done this or could validate our group/product access structure before we proceed?
5. Any tips on admins who already integrated Atlassian Access and Okta to do user provisioning?

Thanks a lot!

Gabriel

[Daniel Eads · Accepted solution]

Hey Gabriel, happy to answer your questions!

1. Is there a prerequisite to have SSO enabled before configuring user provisioning from Okta?
   No, we don't require that SSO is already configured before setting up user provisioning. This is based on the prerequisite list on the Configure User Provisioning with Okta document.
   
   
2. Will existing groups and product access linked to those groups be deleted when activating Atlassian Access and user provisioning with Okta?
   No, in fact we go to extra measures to ensure your existing groups aren't modified at all. Access will throw you an error if there are groups in Okta named the same things as your existing Atlassian Cloud groups. From the unsupported features section of the user provisioning document:
   
   

   Pushing a group from your IdP that has the same name as a group in your organization. Otherwise, you'll get an error when you try to sync.

3. Is it possible to do user provisioning with Okta by assigning users to a group that has no application access? (I have tried by creating a user and assigning it to a group with no product access and this user was automatically redirected to the portal of our JSD instance.)
   Yes, this is actually the default behavior. New groups you create/sync from Okta (for example, "jira-okta-users" and "confluence-okta-users") have no application access. You'll need to modify the applications, projects, and spaces you want to grant access to in order to include those new Okta groups.
   
   
4. Does any vendors have already done this or could validate our group/product access structure before we proceed?
   A quick search turned up that Service Rocket has some experience here as an Atlassian Partner setting this up. Their blog post mentions that they are well set up to take requests for help through their contact form.
   
   
5. Any tips on admins who already integrated Atlassian Access and Okta to do user provisioning?
   My suggestion is reading through our troubleshooting documentation before setup to get some ideas on what not to do in order to have a smooth setup.

Cheers,
Daniel

[Gabriel Viger]

Thanks Daniel :)