What happens with groups after moving to Directory synced users?

[Zane Kellogg]

According to the documentation in user provisioning, you can manage groups and provisioning by groups after connecting to an identity provider. However, what happens to existing groups and group membership when converting to an identity provider?

[John Funk · Accepted solution]

Hi Zane,

It depends on how you set it up. You do not have to have all groups connected to your identity provider. Actually, I would just only one or two, depending on the need. When you connect the group to the provider, though, it will lock it in Jira and can only be updated by the provider. 

[Zane Kellogg]

Hey John, thanks for responding. I have spent time testing this and I agree with you it is easier to manage syncing just a few groups through the identity provider. I have also confirmed that existing groups and membership is not affected as long as those groups are synced across.

[Jill Vieregge]

Question: as the group is locked because it can only be updated by the provider, when I try to make it the DEFAULT ACCESS GROUP for Jira software I get this error. What is the implications of this? What should be the default access group then?

[Jill Vieregge]

@John Funk another question for you above.

[John Funk]

Hey Jill - the default groups are the groups that will automatically be given to the user when their account is setup. If you have a separate group connected to your ID provider (AD, Okta, etc.) then by definition the user will be placed in this group. So you don't need to set it as a default group. 

But I would also grant access to the product to this ID provider established group just to avoid any connection issues for the user. 

[Jill Vieregge]

But you do have to have some kind of Default group specified don't you - so maybe a dummy mirrored group?

[John Funk]

Your default group is usually just the jira-users group.