User is showing Deactivated

[Arpit Gupta]

User which is provisioned through SCIM showing as External User from Google (non-corp) workspace Group into Atlassian is showing Deactivated.

How to reactivate this user?

[Gor Greyan]

Hi @ Arpit Gupta

Welcome to the Atlassian Community!

The user shows as Deactivated and External (non-corp) because their account was likely unassigned or deactivated in the IdP, and SCIM synced this status to Atlassian.

To reactivate:

1. Check IdP (Okta/Azure AD/Google Workspace):

   • Make sure the user is active and assigned to the Atlassian app.

   • If they were removed earlier, reassign them and trigger a SCIM sync.

2. In Atlassian Admin:

   • Go to admin.atlassian.com → Directory → Managed accounts.

   • Confirm if the account is under your managed domain (not external).

   • If it’s external, claim or transfer the account to your domain.

3. If still inactive:

   • Delete the deactivated user in Atlassian.

   • Re-add them in your IdP so SCIM reprovisions a fresh, active account.

4. Validate:

   • After sync, the user should show as Active and Managed in Atlassian.

[Arpit Gupta]

I have checked the Google Cloud IDP side, User status showing ACTIVE.

-----Steps Taken----------

1. I have removed the user from Atlassian.

2. Added user in google group again.

3. User provisioned in Atlassian again but still showing 'Deactivated'.

[Arpit Gupta]

We are trying to setup SAML SSO from Google Cloud towards Atlassian.

Steps Taken:

Configurations In Google Workspace Admin Console:

1. Created 'SAML Atlassian Cloud' App
2. User Access set from the Google Group
3. Updated Service Provider Details from Atlassian SAML Configuration.
4. Enabled AutoProvisioning.
   1. Scope is same Google Group.

Configurations In Atlassian Side

• Added my Domain 'mydomain.altostrat.com'
• Verified Domain & claimed Accounts
• Claimed Users are only 700 available but actual users in my domain is 4000.

1. Created Identity Provider Directory with name 'mydomain.altostrat.com'
   1. Linked domain: 'mydomain.altostrat.com'
   2. Configured SAML SSO.
      1. Created new Authentication Policy with SAML SSO Enabled.
      2. Directory showing 'mydomain.altostrat.com'
   3. Enabled Provisioning.

My Issues are:

1. Users being added to Google Group are provisioning into Atlassian 'Users' as External Users.
   1. User account showing Deactivated
2. I didn’t claim all available users from my domain, claimed users are only 700.

[Gor Greyan]

Dear @ Arpit Gupta

-Go to admin.atlassian.com → Directory → Managed accounts and check the account type.

-If it’s marked as External, you’ll need to:

1. Claim or verify the user’s email domain under Organization settings → Domains.

2. Once the domain is verified, transfer or claim the user so that Atlassian treats them as a managed account.

3. If the account remains deactivated after this, contact Atlassian Support to remove the stale external reference or re-link the SCIM-managed account.

Once the user is recognized as Managed, SCIM will be able to activate and sync them properly.

[Arpit Gupta]

We are trying to setup SAML SSO from Google Cloud towards Atlassian.

Steps Taken:

Configurations In Google Workspace Admin Console:

1. Created 'SAML Atlassian Cloud' App
2. User Access set from the Google Group
3. Updated Service Provider Details from Atlassian SAML Configuration.
4. Enabled AutoProvisioning.
   1. Scope is same Google Group.

Configurations In Atlassian Side

• Added my Domain 'mydomain.altostrat.com'
• Verified Domain & claimed Accounts
• Claimed Users are only 700 available but actual users in my domain is 4000.

1. Created Identity Provider Directory with name 'mydomain.altostrat.com'
   1. Linked domain: 'mydomain.altostrat.com'
   2. Configured SAML SSO.
      1. Created new Authentication Policy with SAML SSO Enabled.
      2. Directory showing 'mydomain.altostrat.com'
   3. Enabled Provisioning.

My Issues are:

1. Users being added to Google Group are provisioning into Atlassian 'Users' as External Users.
   1. User account showing Deactivated
2. I didn’t claim all available users from my domain, claimed users are only 700.

[Arpit Gupta]

@Gor Greyan Do we have nay updated here?

[Gor Greyan]

Hi @ Arpit Gupta

- You should claim all remaining users under the domain

• Go to admin.atlassian.com → Organization → Domains → Claimed accounts.

• Select mydomain.altostrat.com and click Claim accounts to include all users.

• Re-provision the users

  • After claiming all accounts, delete the existing External / Deactivated users from Atlassian.

  • Re-add those users to the Google Group so SCIM re-provisions them as Managed and Active.

• Verify configuration consistency

  • Confirm that both SAML SSO and SCIM provisioning point to the same verified domain (mydomain.altostrat.com).

  • Check that the Identity Provider Directory is linked to this domain.

  • Make sure your Authentication Policy uses this directory with SAML SSO enabled.

• Validate the fix

  • In Google Admin → Atlassian Cloud App → User Provisioning → Logs, confirm users are syncing without “domain not owned” or “external user” errors.

  • In Atlassian Admin → Directory → Managed Accounts, confirm users now appear as Managed and Active.

Here you can find the domain verification article: https://support.atlassian.com/user-management/docs/verify-a-domain-to-manage-accounts/?utm_source=chatgpt.com

User provisioning with Google: https://support.atlassian.com/provisioning-users/docs/configure-user-provisioning-with-google-cloud/?utm_source=chatgpt.com