
Atlassian's suite of applications such as Jira, Confluence, and Crowd, play critical roles in modern workplaces. Jira serves as a versatile project and issue-tracking tool, empowering teams to efficiently plan, monitor, and manage their work. Confluence, on the other hand, fosters collaboration by providing teams with a shared workspace for creating, sharing, and collaborating on content, thereby facilitating seamless knowledge sharing. Crowd acts as the linchpin of user authentication and authorization across multiple Atlassian products, offering a centralized solution for identity and access management.
While these tools have revolutionized productivity, their use has also highlighted the importance of robust Single Sign-On (SSO) solutions. As teams grow and projects become more complex, the need for robust SSO solutions has never been more pressing. SAML (Security Assertion Markup Language) SSO, a trusted approach, is often met with its own set of challenges, ranging from intricate configurations to user management complexities.
To conquer these obstacles, organizations are increasingly turning to SCIM DC – a transformative solution that promises to enhance SSO and identity management within the Atlassian ecosystem. In this bit, we will explore how SCIM DC can be the key to unlocking seamless, secure collaboration.

### The Foundation: Atlassian SAML SSO {#atlassian-saml-sso-foundation}

Atlassian's SAML SSO is a robust solution that allows users to access their applications seamlessly without the need to remember multiple passwords. With SAML, users authenticate once through their identity provider (IdP), and then gain secure access to their Atlassian tools, making the login process more efficient and secure. While SAML SSO solves the authentication challenge, managing user accounts, permissions, and access control remains a separate and complex task.

### The Challenge of User Provisioning and Management {#user-provisioning-channel}

As an organization grows, so does its user base and the complexity of user management. Adding and removing users, assigning appropriate roles and permissions, and keeping user data up to date are critical tasks. Without an efficient user management solution, organizations can face challenges related to compliance, security, and user experience. SCIM (System for Cross-domain Identity Management) DC is the missing piece that complements Atlassian's Native SAML SSO, providing a unified solution for both authentication and user provisioning. Let's explore…

### Unlocking the Magic of SAML SSO+SCIM {#saml-sso-and-scim}

SAML SSO+SCIM DC may sound like a mouthful, but it's actually a powerful addition that simplifies your online access. SCIM and Native SAML SSO are two separate but related technologies that can be used to enhance identity and access management in an organization. While they serve different purposes, they can complement each other to create a more robust and seamless authentication and authorization system. 

&nbsp;&nbsp; 

**Immediate User Provisioning**

One significant advantage of SCIM DC is the immediate user provisioning it offers. With SAML alone, there may be delays between a user being added to your identity provider and then gaining access to Atlassian applications. SCIM DC streamlines the onboarding process, enhancing user experience and productivity. **It eliminates the wait time for new users to access Atlassian applications, increasing efficiency and minimizing disruptions to your team's workflow.** Whether you're bringing in new team members or making updates to your existing user roster, SCIM DC's immediate user provisioning ensures that the right individuals have instant access to the tools they need.

### Advanced Group Management through Provisioning {#advance-group-management}

Let's talk about group mapping. In simple terms, this feature allows you to organize your access to different apps and services. You can create groups and decide who gets access to what. One of the common challenges faced by Jira administrators who set up SSO  is the difference in the groups at IDP with the groups in Jira. Here, SCIM DC automates group assignments. With SCIM, when users log in via SAML, they are automatically placed into the correct groups based on the information provided by your identity provider, such as Azure, miniOrange, or Okta. This eliminates the need for manual group mapping and ensures users have the right level of access.

### Seamless User Status Sync: {#user-status-sync}

Native SAML integration doesn't always keep user statuses synchronized. **For instance, when a user leaves your organization, you would typically have to deactivate their accounts manually within each Atlassian application. SCIM DC can sync user status changes across your Atlassian apps.** When a user is deactivated in your identity provider, SCIM DC will promptly deactivate their accounts in Jira, Confluence, and Crowd. This not only enhances security but also streamlines user management.

### Filter Groups with Custom Rules {#filter-groups-with-custom-rules}

With SAML alone, you might have limited control over which users get access to Atlassian applications based on their attributes, like department or role. SCIM DC allows for flexible group filtering. You can define rules in your identity provider to determine which users are provisioned into which groups within Atlassian applications. For example, you can set up a rule that automatically assigns all users with the "Sales" department in your identity provider to a "Sales Team" group in Atlassian or you can decide that only people whose names start with 'A' can access a particular app.

### Modify Group and Usernames {#modify-group-and-usernames}

Names are important identifiers, but sometimes they need a little tweaking. With SCIM DC, you can modify groups and usernames by applying special rules. It lets you modify group names that come from your IDP. So, if you're tired of seeing group names like "Sales123" and "Sales456," you can use regex to rename them to something clean and consistent, like "Sales." Or you can transform usernames using regex to match your organization's standards thus ensuring uniformity in user identities across all applications.

### Mapping and Customizing Attributes {#mapping-and-customizing-attributes}

Attributes are like the characteristics that make you unique. With Native SAML SSO+SCIM DC, you can map user attributes like username, email, and display name to attributes from your IDP. This ensures that everyone's profile stays up to date, no matter where they log in. In some cases, you might need to add custom attributes to user profiles, which can be challenging with native SAML integration. SCIM DC enables you to add custom attributes to user profiles. For instance, you can include an employee’s ID or a manager’s email of each user, to ensure that important information is readily available within Atlassian applications.

### In a nutshell… {#conclusion}

Atlassian SAML SSO+SCIM DC is your ticket to streamlining user management and boosting security. While SAML SSO ensures secure and streamlined authentication, the SCIM DC takes user provisioning and management to the next level. With automated user provisioning, role-based access control, real-time updates, and simplified onboarding, organizations can enhance their security, compliance, and user experience across Jira, Confluence, and Bitbucket.

&nbsp;&nbsp;  

So why wait? Embrace the power of Atlassian SAML SSO+SCIM DC as the integration offers a compelling solution, making it easier than ever to manage users in Atlassian's suite of collaborative tools. 

Reach us at +1 978 658 9387 for a demo or email your queries to [info@xecurify.com](mailto:info@xecurify.com), we would be glad to take it forward from there.


How can organizations efficiently manage user identities and access, across their Atlassian applications such as Jira, Confluence, and Crowd? This is a pivotal question posed to businesses in this era of ever-evolving workspaces, and digital teamwork as we rely heavily on collaboration and productivity tools to streamline our work processes.

Atlassian SAML SSO with SCIM DC: A Powerful Duo for Synergizing Atlassian's Applications


## Crowd User Management at your fingertips 🙌

Hello Crowd Admins!

An acronym for System for Cross-domain Identity Management, SCIM is an open standard that helps in automating the user identity lifecycle management process.

That’s the industry definition, sounds complicated! Let’s see if we can simplify it a bit with the help of this article. It’s all about ‘identity and access management (IAM),’ the concept has been around for quite some time. Think about if you are able to create a user account in one system and matching accounts automatically get created in other systems the user needs access to.

Sounds amazing but it’s not so simple as each system may have its own unique connection methods such as LDAP, SQL, ADSI, custom APIs, etc. That’s where SCIM comes into the picture, it is designed to make managing user identities in cloud-based services and applications easier, but before we go further let’s dive into…

### Why SCIM? {#why-scim}

Instead of the ‘what’ let’s begin with the ‘why.’ We use different cloud-based SaaS applications such as Salesforce, Zendesk, GitHub, Trello, etc. in our daily work routine depending on our role. These applications were assigned to us when we initially joined. This is done by the IT Admin of the company, now think for a minute if a company has less than 10 employees, manually adding them to the application might work but what if the size of the company runs into hundreds or thousands, the task becomes challenging. And, what about when an employee leaves or is terminated from the company they are removed from the company’s employee directory and all access revoked?

The crowd is the tool given by Atlassian which manages users and groups for all Atlassian apps. Crowd is a centralized directory and the access and authorization to Jira, confluence applications are very much dependent on Crowd.

We are pleased to present to you the app that aims to solve your most complex problem. Syncing & Managing users in a crowd is now a problem of the past! Introducing the miniOrange [Crowd SCIM Plugin](https://marketplace.atlassian.com/apps/1229918/mo-scim-provisioning-user-group-sync-for-crowd?hosting=datacenter&tab=overview) 🎉

The Crowd SCIM plugin connects Crowd with your Identity Provider. You can connect different Identity Providers such as Okta, Azure AD, Onelogin, Keycloak, G Suite and any SCIM Supported IDPs for provisioning. Unleash the true potential of Crowd giving you access to features like:-

**Provision & De-Provision users 🔁**

Easily provision and de-provision users in Crowd in sync with your Identity Provider.

**Update/Activate/Deactivate users ✅**

Automatically update the details of users, and activate and deactivate user accounts (If deleted or deactivated in IDP) to save extra license costs and improve the security of your organization.

**Real-Time Provision Users 🚀**

As soon as a user is created on your Identity Provider, it will automatically be created in Crowd, in REAL TIME!!!!

**IDP App-specific provisioning 🖥️**

You can choose provisioning features based on your configured IDPs. Isn’t that great?

**Transform username based on regex for matching user 🧑‍**

Do your users have different usernames in your IDP and different usernames in Crowd? We’ve got you covered. This feature will allow you to transform the username received from the IDP and create or update the desired username in Crowd.

![Crowd User Management Sync](https://miniorange.com/atlassian/wp-content/uploads/sites/14/2023/01/Crowd-SCIM.webp)

I hope you enjoy this plugin as much as we did while creating it. While this is what we’re offering now, here’s our roadmap for the next release:

-   Upcoming Features 🛣️

-   Scheduled Provisioning

-   Filter users by groups for assigning

-   Manual user sync button

-   Sync/update users upon successful authentication

Feel free to reach out to us at [atlassiansupport@xecurify.com](mailto:atlassiansupport@xecurify.com) for a free demo, setup, or any custom use case. We’re happy to help 😄

Try the miniOrange Crowd SCIM plugin today!


Use Crowd SCIM to sync your users, groups and directories with SCIM for Server/DC. Support for Azure AD, Okta, Onelogin, Oracle IDCS, ... IDPs

Crowd User Management at your fingertips


## Simplifying Collaboration with OAuth SSO and SCIM {#how-atlassian-oauth-sso-and-scim-app-simplifies-user-management-and-collaboration}

Ever wondered how teams navigate the intricate landscape of digital collaboration and evolving workspaces? A team seamlessly orchestrating projects with tools like Jira and Confluence. But, as teams and projects grow, a new question arises: How do we simplify the authentication process without compromising security? To address the situation, the recommended approach is to incorporate the SCIM app with Atlassian OAuth Single Sign-On (SSO) for a more streamlined and effective solution.

&nbsp;

Jira excels as a project tracker, and Confluence plays a central role in collaborative content creation. User authentication across Atlassian products is crucial, and a robust Single Sign-On (SSO) solution becomes increasingly vital as these applications enhance productivity.

### Advancing Authentication: Atlassian OAuth SSO {#advancing-authentication}

Embracing the demand for streamlined and user-friendly authentication, Atlassian OAuth SSO emerges as a powerful evolution in secure access, eliminating the hassle of multiple passwords for users. As organizations navigate the complexities of growing teams and intricate projects, the shift to Atlassian OAuth SSO becomes a game-changer.

&nbsp;

However, for enhanced SSO and identity management, organizations turn to SCIM apps, either for Jira or Confluence – the transformative solution within the Atlassian ecosystem. Atlassian OAuth SSO ensures a streamlined login process, where users authenticate once through their identity provider (IdP) and gain secure access to Jira, and Confluence. However, the challenge lies in effective user provisioning and management.


### User Provisioning: The Missing Piece {#user-provisioning-the-missing-piece}

SCIM app transforms the puzzle of identity management into a work of art. It seamlessly integrates with Atlassian OAuth SSO, providing a unified solution for both authentication and user provisioning. Atlassian OAuth SSO brings the power of single sign-on, simplifying access for users across various Atlassian products. Meanwhile, SCIM app steps in as the missing piece, extending this simplicity to user provisioning, ensuring that user information is consistently accurate and up-to-date.

&nbsp;

This integration doesn't just stop at efficiency; it also fortifies security. By combining the robust authentication of Atlassian OAuth SSO with the seamless provisioning of SCIM, organizations can create a fortress of identity management. This not only safeguards against unauthorized access but also ensures that the right individuals have the right level of access at all times.

&nbsp;

Let's dive into how this dynamic duo, Atlassian OAuth SSO+SCIM App, can redefine your collaboration experience.


### Instant Gratification: Immediate User Provisioning {#instant-gratification-immediate-user-provisioning}

The concept of "Instant Gratification" within the context of SCIM app immediate user provisioning heralds a significant transformation in the landscape of user onboarding processes. In traditional systems, there exists a temporal gap between the moment a user is added to an identity provider and when they are granted access to specific applications, such as those provided by Atlassian.

&nbsp;

SCIM addresses this challenge by introducing a revolutionary approach that eliminates the delays associated with user provisioning. No more delays between adding a user to your identity provider and gaining access to Atlassian applications. This boosts efficiency, minimizes disruptions, and ensures that your team has instant access to the tools they need.

&nbsp;


### Dynamic Group Mapping: Effortless Synchronization {#dynamic-group-mapping-effortless-synchronization}

Mapping Identity Provider (IdP) groups to application groups with SCIM, streamlines user group and permission management. This enables automatic assignment and updates of user groups and permissions based on changes in IdP groups. For instance, if a user belongs to the administrators group on IdP, admin permissions can be assigned through mapping. If the user is later removed from the administrators group on IdP, they will be automatically removed from the application admin group.

&nbsp;

The mapping process provides two distinctive approaches: **Manual Group Mapping and On-The-Fly Group Mapping**. Manual Group Mapping is the preferred choice when there is a disparity between IdP group names and local application group names, necessitating the manual association of each IdP group with its counterpart in the application. On-the-Fly Group Mapping, on the other hand, is advantageous when IdP group names precisely match local application group names.

&nbsp;


### Syncing User Status with Ease {#syncing-user-status-with-ease}

While Atlassian OAuth SSO provides a robust single sign-on solution, ensuring synchronized user statuses poses a considerable challenge. In response, SCIM app emerges as the essential tool for seamlessly managing user status changes throughout your Atlassian suite, encompassing Jira and Confluence.

&nbsp;

When a user departs from an organization, SCIM app promptly deactivates their accounts across all integrated platforms. This proactive measure not only enhances security by swiftly revoking access but also simplifies the intricate process of user management. SCIM's synchronization capabilities extend beyond mere deactivation; it enables real-time updates, promptly reflecting changes in user roles and permissions across Atlassian applications. This not only ensures enhanced security but also contributes to cost savings by efficiently managing licenses through timely deactivation.

&nbsp;

### Tailored User Identities: Modify Group and Usernames {#tailored-user-identities-modify-group-and-usernames}

SCIM app allows you to modify groups and usernames with special rules. By implementing customized rules for groups and usernames, organizations can not only achieve uniformity but also bolster their security posture. Moreover, our SCIM app  provides the ability to transform usernames systematically, ensuring that they adhere to your organization's standards.

&nbsp;

This not only promotes clarity but also aids in preventing potential security vulnerabilities associated with inconsistent or non-compliant usernames. Consistent and well-structured user identities across applications contribute to a more efficient and secure identity management system, ultimately enhancing the overall cybersecurity framework of your organization.

&nbsp;

### Attributes Redefined: Mapping and Customization {#attributes-redefined-mapping-and-customization}

Attribute mapping involves associating specific user details. By mapping key attributes like username, email, mobile number, and display name to your identity provider, you ensure precise user profiles, fostering a seamless environment across Atlassian applications. This process guarantees consistency and accuracy in user profiles across various platforms.

&nbsp;

It enables organizations to synchronize and uphold uniform information, promoting seamless data exchange and enhancing overall system interoperability. Attribute mapping and customization not only boost accuracy but also contribute to a more personalized and efficient user experience.

&nbsp;

### Embrace the Power: Atlassian OAuth SSO+SCIM App {#embrace-the-power-atlassian-oauth-sso-scim-app}

In a nutshell, Atlassian OAuth SSO+SCIM app is your ticket to streamlined user management and heightened security. While OAuth SSO ensures secure authentication, SCIM takes user provisioning and management to the next level. With immediate provisioning, automated group mapping, and real-time updates, organizations can elevate their security, compliance, and user experience across Atlassian's collaborative tools.

&nbsp;

Don't wait! Embrace the power of Atlassian OAuth SSO+SCIM App today. Experience a compelling solution that makes managing users in Atlassian's collaborative tools easier than ever. For a demo, reach us at **+1 978 658 9387**or email your queries to **support-atlassian@miniorange.atlassian.net**. We're eager to hear from you.



The Atlassian OAuth SSO+SCIM DC combination is not just a solution; it's an invitation to elevate your collaboration effortlessly. In this article, let’s go on a journey into the dynamics of Atlassian OAuth SSO paired with SCIM DC. A powerful integration that redefines user authentication, provisioning, and management across Jira and Crowd. Uncover the seamless synergy of this transformative duo as it elevates the overall user experience.

How Atlassian OAuth SSO and SCIM App Simplifies User Management and Collaboration


## How miniOrange SCIM Simplifies Centralized IDP User Management in Atlassian Apps

If your business relies on various Atlassian applications and services to conduct your day-to-day operations, you would certainly relate that managing user accounts and their access could be challenging and often time consuming. This is where **miniOrange’s User Sync/SCIM** App comes into play.

SCIM an acronym for ‘System for Cross-domain Identity Management’ is a protocol that allows for automated provisioning and de-provisioning of user accounts between different systems. Our app allows seamless login into the **Jira, Confluence. Bitbucket, Crowd** and other Atlassian applications with Identity Provider (IdPs) like [Azure Active Directory, Keycloak, Okta, OneLogin, Oracle and more.](https://developers.miniorange.com/docs/atlassian/scim/overview)

To get a better understanding of its use cases, let’s take Okta as the identity provider and an application, say Jira:

### New Employee Onboarding (User Creation) {#user-creation}

When we talk about user creation, we refer to the process of adding a new user account to various systems that they may require. This usually happens when a new employee joins an organization and would need access to, say for instance, a team collaboration tool (Confluence) or a project management tool (Jira), if a developer then probably a tool to effectively store, manage and monitor codes (Bitbucket).

Let’s say when a new employee joins your company, the IT administrator with user information like username, email, and other relevant details would create a new user account in Okta (IDP), and then miniOrange User Sync/ SCIM ensures that accounts created in Okta is automatically replicated in Jira, profiles and attributes are in sync between both the systems.

### Change in User Information (User Updation) {#user-updation}

User information like email address, phone number, or role may change over time, and it’s essential to keep this information updated and ensure that it is consistent in all applications. Any such changes can also be automatically updated using miniOrange User Sync/ SCIM. Admins can easily update user information in Okta and those changes would reflect in Jira.

For example, if a user changes their phone number, you can update that information in Okta and the changes would be synced in Jira so that it’s consistent with both systems.

### Revoking User Access (Deactivation) {#user-deactivation}

When an employee leaves the company their access to company resources should be removed to maintain security and compliance. It also could be the case that a user’s access to certain systems needs to be revoked based on role change. This process of deactivation is automated just like the above with the app and once a user is deactivated in Okta, SCIM App will automatically deactivate the corresponding user in Jira.

For example: if an employee leaves the company, the HR department would disable their account in Okta and the miniOrange User Sync/SCIM would then automatically disable or remove the user’s account in Jira so that their access to the application is revoked.

### Assigning Groups to Users (Group Mapping) {#assigning-groups-to-users}

![SCIM flow diagram](/blog/assets/2023/miniorange-scim-for-atlassian-apps.webp)

Another essential use case is that it enables admins to manage user access to different resources and applications based on their group, in other words, it refers to the process of associating users with specific groups. With miniOrange User Sync/SCIM, you can map users to groups in Okta and Jira. This ensures that users have the necessary access to resources based on their roles and responsibilities. Group mapping can be done manually or [on the fly](https://developers.miniorange.com/docs/atlassian/scim/user-groups).

**Manual Group Mapping** involves manually assigning users to groups in Okta and Jira. It is useful when your IdP group names and local application group names are different here you would have to map each IdP group to the application group manually.

It allows you to manually map Jira groups with the groups from Okta or filter groups, and make changes to existing users. Manual Group Mapping is useful when you want to manage groups from Okta but the group name differs in Okta and Jira.

For example, if the name of the group in Okta is Dev users but the name of a similar group in Jira is Software_dev. In such scenarios, you would have to manually map each Okta group to the Jira group.

**On-the-fly** group mapping refers to the process of dynamically mapping users to groups. For instance, when group names in Okta and Jira are an exact match, the app would detect the groups and add users to those groups automatically and if a group doesn’t exist in Jira then it would be created.

Let’s say for better clarity, you use Okta for identity and access management and Jira for project management. There are several teams working on different projects, each team has its own group with a unique name, here let us consider “Marketing” group in Okta and a “Marketing” group in Jira. When a new user joins the company, they are added to Okta, and their profile contains information about which team they belong to.

As there is an integration between Okta and Jira using the miniOrange app that supports on-the-fly group mapping. The app detects the team information from Okta and checks if a group with the same name exists in Jira. If a group with the same name exists, the user is automatically added to that group, in this case, “marketing” if not, then a new group ‘marketing’ is created in Jira and the users are added.

The above are just a few of the most common use cases but it’s not just limited to that. **Identity Migration**-moving from one IdP to another, **SSO (Single Sign-On)** can be integrated with our SCIM app, **attribute transfer** to a relying party’s website and more. That brings us to…

### How Do IT Administrators Working with Atlassian Applications Benefit? {#benefits-for-it-admins}

Our SCIM integration offers various benefits to Atlassian application users, be it **Confluence, Jira, Bitbucket, or Crowd.** It is a popular solution among IT admins for user provisioning and de-provisioning. One of the main advantages of SCIM is that it **saves licensing costs** as it automates the user provisioning and de-provisioning process. Organizations with a large number of users can reduce the number of licenses needed for applications thus saving a significant amount of money.

The addon ensures that resources are allocated more efficiently as new users are automatically provisioned with the appropriate access rights. miniOrange User Sync/SCIM allows for **granular control** so that users only have access to the resources they need thus **mitigating the risk of unauthorized access.** All leads to **enhanced security** by ensuring that user access is granted or revoked in a timely manner.

Companies can expect an **increase in productivity** as our app eliminates the need for manual user provisioning and de-provisioning so that your IT staff can focus on more critical tasks. The automated process **reduces the risk of manual errors** as well. With these benefits, your business can look to **improve the overall user experience** eventually leading to higher user satisfaction.

### Summary {#summary}

If you are here, that means you took the time to go through the use cases and the overview of our app. No more time-consuming manual onboarding and offboarding users, employees get easy and quick access to the apps they need to work. You get automated access management that not just saves you time but also money.

You could also go through our other apps that compliment ‘lifecycle management’ such as SSO that would work in tandem to keep you secure. So, set up your employees fast with what they need, and unburden your IT team to focus on the bigger picture. Looking for something specific? Please contact us at **support-atlassian@miniorange.atlassian.net** or raise a support ticket [here](https://miniorange.atlassian.net/servicedesk/customer/portal/2), and keep watching this space for more new and innovative solutions.


SCIM an acronym for ‘System for Cross-domain Identity Management’ is a protocol that allows for automated provisioning and de-provisioning of user accounts between different systems. Our app allows seamless login into the Jira, Confluence, Bitbucket, Crowd and other Atlassian.

How miniOrange SCIM Simplifies Centralized IDP User Management in Atlassian Apps


## How miniOrange User Sync/SCIM Automates User Provisioning for Atlassian DC applications {#how-miniorange-user-sync-automates-user-provisioning-for-atlassian-dc-applications}

Managing users in Atlassian manually, especially in situations with large numbers of users, is time-consuming and prone to human error. With employees joining various departments and projects on a regular basis, a lot of time is spent on managing users with the access they need which can lead to users being provisioned incorrectly.

[miniOrange User Provisioning](https://marketplace.atlassian.com/search?query=miniOrange%20User%20Sync) for Atlassian applications comes packed with a variety of powerful features. With the miniOrange User Provisioning app, employee/user accounts can be created, updated, deleted, and given proper access across multiple applications at the same time. The procedure of adding, updating, and deleting users, as well as managing their access, is automated. 

&nbsp;

![user-sync-scim](/blog/assets/2023/user-sync-scim-automate.webp)


When it comes to Atlassian products such as Jira, Confluence, and Bitbucket you can use Just-in-time provisioning provided with the Single Sign-On functionality of Atlassian Data Center. The native SSO functionality of Atlassian allows you to update the users and their groups at the time of SSO login. **However, for most enterprises, this does not fulfill the overall requirement.** 

Atlassian SSO updates users and groups only at the time of SSO (Just in Time Provisioning). 

&nbsp;
 

Most Atlassian customers implementing SAML use the attributes sent in the SAML response to provision users just-in-time. 

 &nbsp;

Using Just In Time (JIT) Provisioning, you receive all group and user information from your Identity Provider. JIT provisioning will remove any existing Jira or Confluence groups that are not in the SSO response. Managing a few groups within Jira or Confluence will never work in this scenario. **If you are manually managing some groups, that will not work with Atlassian SSO. This is one of the shortcomings of Atlassian’s provisioning model and may not be an ideal solution for Enterprises.**

&nbsp;

In this article, we will go over the top provisioning features that you won’t find in Atlassian’s inbuilt User Provisioning in Data Center – but you will find in miniOrange’s User Provisioning App. 

&nbsp;

Let’s see what the miniOrange User Provisioning app offers along with Just-in-time provisioning:
 
- **Real-time provisioning**– your user and group information will get automatically updated every time the user’s data is updated in the Identity Provider. 

- **Sync the User from a particular group or an application** – You can sync users from a particular group or application if you do not want all your users synchronized. Members from only that group will be synchronized. 

- **User Deactivation/Delete from Jira/Confluence** - According to some estimates, approximately 30% of all Atlassian user licenses are unused. This happens because users that leave the organization or change roles don’t have their accounts deactivated in a timely manner. Atlassian users whose accounts haven’t been deactivated can have negative consequences, like exceeding license limits leading to an increase in licensing costs and retaining access from former employees – posing major security concerns.

&nbsp;&nbsp;

**Just-in-Time provisioning cannot be used to deactivate the user since the SSO process involves active user accounts.** You can manually remove the user from the Jira group but it will still consume the licenses. 

With the help of our User Provisioning Add-on, you can **automatically deactivate and delete multiple users** from specific groups. Users can be automatically deleted based on their status in the directory. 

- **Synchronization of User Directories:** the miniOrange User Sync plugin can synchronize entire directories with the help of Real-time provisioning. When user directories are synchronized, new users will automatically be added in the respective Atlassian applications. With User Directory Synchronization you can also sync IDP-specific directories. You can also schedule synchronization which provides proactive provisioning and de-provisioning of users and groups at regular intervals (sync).

- **User name and Group transformation –** Native SSO provisioning requires you to provision the user with the same username as IDP. However, with username transformations, you can associate the provisioning of users with different values. Filtering groups will help you to manage access and permissions within Jira or Confluence easily.

Apart from this, the [miniOrange User Provisioning](https://marketplace.atlassian.com/search?query=miniOrange%20User%20Sync) App offers a wide range of features focusing on provisioning users from your IDP directory into Atlassian Applications. Below is the detailed comparison of the [miniOrange User Provisioning app](https://marketplace.atlassian.com/search?query=miniOrange%20User%20Sync) with native Atlassian. 

### miniOrange User provisioning Features {#miniorange-user-provisioning-features}

1. Supports SCIM 2.0 and SCIM 1.1 protocol	
2. On- the fly group mapping
3. Manual Group Mapping	
4. Default Group Mapping
5. Sync History
6. Provision to map groups from IdP to local groups

**Ready for the action? Install User Sync today!**

 &nbsp;&nbsp;

It’s really easy to manage users via our developed user provisioning add-ons which can be connected with your IDPs ([Azure AD](https://www.miniorange.com/atlassian/jira-scim-user-and-group-provisioning-for-azure-ad), [Okta](https://www.miniorange.com/atlassian/jira-scim-user-and-group-provisioning-for-okta), [OneLogin](https://www.miniorange.com/atlassian/jira-scim-user-and-group-provisioning-for-onelogin), [G suite](https://www.miniorange.com/atlassian/user-and-group-sync-user-provisioning-g-suite/), [Keycloak](https://www.miniorange.com/atlassian/user-and-group-sync-for-keycloak)) or any other SCIM compliance applications so when you setup your Jira Azure AD SCIM or Jira Okta SCIM, user sync plugin will make it a cakewalk for you. Follow the guide to quickly set it up for the Data Center version.

 &nbsp;&nbsp;
 
The add-on also works with [Single Sign On](https://marketplace.atlassian.com/search?query=miniOrange%20Single%20Sign%20On%20) where SSO is used for authentication and User sync application is used for automatic provisioning.


&nbsp;&nbsp;


Contact Us – Drop us a mail at **info@xecurify.com** or [raise a ticket here](https://miniorange.atlassian.net/servicedesk/customer/portal/2) to talk to us.





Managing users in Atlassian manually, especially in situations with large numbers of users, is time-consuming and prone to human error. With employees joining various departments and projects on a regular basis, a lot of time is spent on managing users with the access they need which can lead to users being provisioned incorrectly.

How miniOrange User Sync/SCIM Automates User Provisioning for Atlassian DC applications


## Jira Cloud SCIM/User Sync: Embrace Multiple IDPs and Customer Sync Freedom for Individual Applications {#jira-cloud-scim-user-sync}

&nbsp;

Is your business facing the challenge of synchronizing customer data along with integrating multiple identity providers (IDPs) for sync? Atlassian users look no further than our user management plugin [‘Jira Cloud SCIM/User Sync’](https://marketplace.atlassian.com/apps/1222000/mo-scim-provisioning-user-sync-group-sync-for-jira?hosting=cloud&tab=overview) which redefines the process, while seamlessly managing user identities and data synchronization.

&nbsp;

Let’s delve into the features of this groundbreaking plugin and see how it empowers enterprises to overcome the tedious task of synchronizing users/groups from multiple IDPs and streamlining customer data across multiple platforms.

&nbsp;&nbsp;

### Seamless Integration with Any IDP {#seamless-integration-with-any-idp}

&nbsp;

We begin with one of the key features, its ability to seamlessly integrate with any identity provider for synchronizing users. Whether your business relies on popular providers like Okta, Azure, or miniOrange, or you have a custom-built IDP, this plugin eliminates the hassle of performing different CRUD and User provisioning operations based on systems. It provides a unified interface for user provisioning, enabling developers to focus on building innovative applications rather than worrying about IDP compatibility.

&nbsp;

For instance, if an organization has customer identities managed in multiple Azure directories or in different entities like Okta and Azure AD, it would be a headache to manage these Identities at the same time on the Enterprise level. However, you can leverage our plugin to consolidate your user provisioning process and utilize both Azure and Okta simultaneously without having to choose one over the other and provide a seamless user experience across multiple applications..

&nbsp;&nbsp;


### Independent Application Development {#independent-application-development}

In the past, managing multiple users and groups manually has been a complex and time-consuming task. However, our plugin offers a solution that allows businesses to develop applications that are not limited to a single IDP or a specific method of customer and user synchronization. It provides flexibility and independence in integrating with different systems..

&nbsp;

For example, multiple SCIM connections (System for Cross-domain Identity Management to System for Cross-domain Identity Management): In this scenario, our plugin enables an application to synchronize user data between two or more IDPs that support the SCIM protocol. The application can retrieve user information from one SCIM-based IDP and synchronize it with another SCIM-based IDP.

&nbsp;

Likewise, you can create multiple connections for the SCIM or the REST API Connectors or a combination of both, while maintaining a unified user experience across different platforms.

### Flexible Customer Sync Options {#flexible-customer-sync-options}

When businesses use multiple applications, it's important for them to keep their customer data synchronized, meaning that the data is consistent and up-to-date across all the applications they use. Our plugin for JIRA makes it easy to manage this synchronization process. It gives you a lot of flexibility and customization options. You can decide how you want the synchronization to happen.


&nbsp;

For example, you can choose to sync the data in real-time, meaning it happens instantly as changes are made. Alternatively, you can do a group sync, where the data is synchronized in groups at specific intervals, control access to portals based on IDP groups and organizations. You can even choose to manually sync the data when you want. This flexibility ensures that your customer data stays current in all your applications, without affecting performance or the experience of your users.

### Enhanced Security and Privacy {#enhanced-security-and-privacy}

When we deal with user identities and sensitive customer data, our top priority is to ensure security and privacy. Our plugin is designed to ensure that the right people have appropriate access to your system. By implementing granular access levels, we provide a robust user management solution that allows you to assign and control permissions with precision.

&nbsp;

Administrators are empowered with comprehensive control, while users can perform advanced tasks within predefined boundaries. You can confidently regulate access and safeguard sensitive resources, ensuring that only authorized individuals can interact with them.

&nbsp;

By implementing these measures, we aim to maintain the highest level of security for user data throughout the entire process.

### Wrapping It Up {#wrapping-it-up}

With seamless IDP integration, Jira Cloud SCIM/User Sync offers a powerful solution for organizations seeking to enhance their user management capabilities. By integrating with your Identity Provider (IDP), it streamlines the user provisioning and management processes, ensuring a seamless experience for both administrators and end-users.

&nbsp;
By leveraging the SCIM functionality to Jira cloud, you can focus on delivering exceptional user experiences. With streamlined user management processes, you can devote more time and resources to building engaging applications and features that delight users. Our solution puts you in control by seamlessly integrating with multiple IDPs and facilitating customer sync, allowing you to maintain governance over your applications and data.

&nbsp;

To learn more about [Jira Cloud SCIM/User Sync](https://marketplace.atlassian.com/apps/1222000/mo-scim-provisioning-user-sync-group-sync-for-jira?hosting=cloud&tab=overview) or if you have specific inquiries, you can contact us at **support-atlassian@miniorange.atlassian.net** or raise a support ticket [here](https://miniorange.atlassian.net/servicedesk/customer/portal/2). Stay tuned to this space for more new and innovative solutions as we continue to enhance our offerings and deliver cutting-edge solutions to meet your evolving needs.


Contact Us – Drop us a mail at **info@xecurify.com** or [raise a ticket here](https://miniorange.atlassian.net/servicedesk/customer/portal/2) to talk to us.





Unlock exceptional user experiences while maintaining control over applications and data with Jira Cloud SCIM/User Sync. Seamlessly integrate your Identity Provider, develop custom applications, sync customer data, and enjoy enhanced security measures.

Jira Cloud SCIM/User Sync: Embrace Multiple IDPs and Customer Sync Freedom for Individual Applications


## Seamless SSO and Identity Management {#seamless-sso-and-identity-management}

In the ever-evolving landscape of digital identity, achieving simplicity and efficiency is paramount. With the latest upgrade to the miniOrange SAML plugins, we're excited to announce the seamless integration of SCIM (System for Cross-domain Identity Management). This transformative addition, bundled for free with the miniOrange SAML plugins, brings a new dimension to your identity management strategy. 

&nbsp;

**This upgrade is available for all the following plugins:-**
1. [JIRA SAML Plugin](https://marketplace.atlassian.com/apps/1215430/mo-jira-saml-sso-single-sign-on-jira-sso-login?hosting=datacenter&tab=overview)
2. [Confluence SAML Plugin](https://marketplace.atlassian.com/apps/1215542/mo-confluence-saml-sso-single-sign-on-confluence-sso-login?hosting=datacenter&tab=overview)
3. [Bitbucket SAML Plugin](https://marketplace.atlassian.com/apps/1216482/mo-bitbucket-saml-sso-single-sign-on-bitbucket-sso-login?hosting=datacenter&tab=overview)

### Unlocking Synergy: SAML and SCIM in Harmony {#unlocking-synergy-saml-and-scim-in-harmony}

**Effortless Onboarding and Offboarding** 🧑‍🤝‍🧑
Imagine a new team member, Sarah, joining your organization. SAML seamlessly grants her access across applications with Single Sign-On (SSO). Before that, SCIM works behind the scenes, instantly creating her accounts and access rights. When another employee John leaves the company, SCIM steps in again, ensuring immediate removal of his access across all applications without manual intervention.

&nbsp;

**Streamlined User Attribute Management** 🚴
Maintaining consistency in user attributes is crucial. For instance, when Sarah gets promoted and joins a new team, SCIM ensures her updated role and group memberships are uniformly reflected across all applications. This meticulous approach eliminates discrepancies in user profiles and enhances accuracy.

&nbsp;

**Enhanced Security through Real-time Access Management** ⏳
Picture this: David, a team member, is terminated. SAML provides secure and straight forward authentication, and when combined with SCIM, it allows you to instantly revoke David's access. This immediate response fortifies your security posture and minimizes potential risks by promptly removing access for deactivated or terminated users.

&nbsp;

**Scalable Identity Management for Growing Organizations** 🦸
As your organization expands, managing user identities can become complex. SAML ensures a unified and secure authentication process. Now, consider Sarah's team growing. SCIM simplifies the complexity of user provisioning, allowing you to easily scale your identity management processes without compromising efficiency. In this dynamic scenario, imagine new team members joining rapidly. SCIM, the superhero of identity management, automates user provisioning, ensuring seamless access for new members to the tools they need. This dual approach of SAML and SCIM not only guarantees a secure authentication process but also streamlines identity management, making it agile and scalable as your organization evolves.

&nbsp;

### How to Experience the Synergy: {#how-to-experience-the-synergy}

1. Update Your miniOrange SAML Plugin to the latest version.
2. Go to the “SCIM” tab in the settings section. You need to download the SCIM plugin separately but it will be available at no extra cost once you purchase our SAML plugin.
3. Here, you can seamlessly configure and customize your SCIM settings to align with your organization's requirements.
4. Once configured, witness the harmonious collaboration between SAML and SCIM. Enjoy the benefits of secure SSO and automated user provisioning, making identity management a smooth and efficient process.

&nbsp;

**Elevate Your Identity Management Strategy** 👆
With SAML and SCIM working in tandem, miniOrange offers a robust solution for organizations seeking a streamlined, secure, and scalable identity management strategy. Upgrade your miniOrange SAML plugin today to unlock the combined power of SAML and SCIM, where simplicity meets security in the realm of digital identity.



In the ever-evolving landscape of digital identity, achieving simplicity and efficiency is paramount. With the latest upgrade to the miniOrange SAML plugins, we're excited to announce the seamless integration of SCIM.

Seamless SSO and Identity Management: Unleashing the Power of SAML and SCIM Integration in miniOrange Plugin 🚀


## User Provisioning App : Keeps you in sync with multiple Atlassian applications! {#keeps-you-in-sync-with-multiple-atlassian-applications}

[Advanced Option for Atlassian SSO Plugin](https://marketplace.atlassian.com/apps/1229209/advance-options-for-atlassian-sso?hosting=datacenter&tab=overview)

Picture this: You have 1000s of users. Each user accesses multiple atlassian applications like Jira and Confluence and some of them keep facing issues with user access, activation and deletion which by the time you resolve, you have another pile waiting for you. Sounds familiar? 

&nbsp;&nbsp;

How are you going to manage user provisioning and de-provisioning and access of every user for each application? Manually managing large numbers of users is equivalent to putting out fires all day long. We’ve got you covered with our User Provisioning /SCIM add-on, which can help you to handle your users/employees instantly and effortlessly across atlassian applications for Jira SCIM and Confluence SCIM. Wondering how is it possible? We will help you to understand exactly how it can be done.

### What is User Provisioning and Deprovisioning? {#user-provisioning-and-deprovisioning}

User Provisioning is the process of creating, updating and/or deleting a user’s account and access through multiple applications at once. In our particular case this user sync or SCIM can be applied to Atlassian applications for Jira User Sync and Confluence User Sync. Provisioning provides information about users / employees such as their name, attributes, groups and other relevant data allowing them to grant or revoke access as required. Some of the real time examples like hiring, promotions, transfers can set off provisioning. Provisioning ensures user’s access rights are up to date, without manual efforts for each user across all applications.

&nbsp;&nbsp;


### Why is User Provisioning / Deprovisioning important? {#Why-is-user-provisioning-deprovisioning-important}

- Automatically create, update, deactivate or activate user accounts across applications.
- Saves time, manages users directory at one place and keeps everything else sync with directory.
- Automatically assign role-based permissions within apps
- Ensure the prevention of unauthorized access by automatically revoking access to all apps at once – de-provisioning.

### Ready for the action? Install User Sync today! {#ready-for-the-action-imstall-user-sunc-today}

- It’s really easy to manage users via our developed user provisioning add-ons which can be connected with your IDPs (Azure AD, Okta, OneLogin,G suite, Keycloak) or any other SCIM compliance applications so when you setup your Jira azure AD SCIM or Jira Okta SCIM, user sync plugin will make it a cakewalk for you. Follow the guide to quickly set it up for the Server or Data Center version.
- The add-on also works with Single Sign On where SSO is used for authentication and User sync application is used for automatic provisioning.

 
Contact Us – Drop us a mail at **info@xecurify.com** or [raise a ticket here](https://miniorange.atlassian.net/servicedesk/customer/portal/2) to talk to us.





User Provisioning is the process of creating, updating and/or deleting a user’s account and access through multiple applications at once. In our particular case this user sync or SCIM can be applied to Atlassian applications for Jira User Sync and Confluence User Sync.

User Provisioning App : Keeps you in sync with multiple Atlassian applications!


### What is SCIM? {#What-is-SCIM?}

[SCIM – The System for Cross-domain Identity Management](https://plugins.miniorange.com/shopify-scim-user-provisioning), is an open standard that involves the process of creating, updating, and deleting user accounts in multiple applications and systems. It is an Identity and Access Management (IAM) solution that includes management and maintenance of an end user’s identity and user attributes in relation to accessing resources available in one or more systems. Real-time user syncing can be easily achieved using SCIM.

### How does Shopify SCIM Provisioning / Deprovisioning Works? {#How-does-Shopify-SCIM-Works?}

Shopify SCIM integration enables automating the process of [**provisioning / de-provisioning of user identities**](https://www.miniorange.com/products/user-provisioning). Shopify SCIM User Provisioning allows you to sync users’ creation, updating, and deletion with other websites of your business. **SCIM Provisioning** works with existing web model standards like REST and JSON-based protocol that defines a client and server role making it easy to implement. A client is usually an Identity provider (IDP), which contains user identities. A Service Provider (SP) is usually a SaaS app, like Shopify, that needs a subset of information from those identities. When changes to identities are made in the IdP (Identity Provider), including create, update, and delete, they are automatically synced to the SP according to the SCIM protocol. In addition, the IdP can detect identities in the service provider and add them to its database.

### Why choose SCIM for Shopify? {#Why-choose-SCIM-for-Shopify?}

**Shopify SCIM** integration allows to communicate user’s data between Shopify and several other Identity Providers **(Okta, Azure)**, this enables IT departments to automate the **provisioning / deprovisioning** process while also having a single system to manage permissions and groups. It mitigates the risks associated with employees using the same password across different **Shopify stores** and applications. It simplifies the user experience by automating the user identity lifecycle management process. **Shopify SCIM Provisioning and De-Provisioning** application gives you the ability to automate user creation, updating, and disabling tasks in Shopify by directly interacting with the Identity Provider Admin Dashboard (Okta, OneLogin, Azure, etc.)

![shopify-automated-user-provisioning-deprovisioning](/blog/assets/2023/shopify-automated-user-provisioning-deprovisioning.webp)

### How will SCIM Protocol help to overcome the challenges faced by non-SCIM users? {#How-will-SCIM-Protocol-help-to-overcome-the-challenges-faced-by-non-SCIM-users?}

Shopify SCIM provisioning **creates, updates, disable, handles** all identities (user accounts) across different Shopify stores and all other connected IT Infrastructure and applications.

- Suppose an IT department sells their products on their Shopify store. For every new hire suppose the IT department takes approximately 5-10 minutes to set up an employee account in both the department and the Shopify store which is an enormous amount of time when scale to hundreds of new joiners. This time can be reduced by using the SCIM provisioning process. If the IT company application support SCIM protocol then using the Shopify SCIM application, whenever an employee is added to their identity providers, then the same employee is created as a customer in their Shopify store and vice versa.

- Organizations would have to cease trading if they manually manage every employee/user account detail across several business applications and Shopify stores. SCIM Provisioning allows seamless and automated control of all information updates that must be made when a group of users’ data changes – for example, address updates, account disables, new enrollments/creations, permission management, and so on.

- SCIM provisioning also significantly improves new employee onboarding — no one wants to sit and create multiple user accounts on their first day of work.

- SCIM has a number of security advantages. When an employee is fired or leaves a company, the offboarding process is usually inconsistent. Consider a scenario where the administrators forget to de-provision the user’s account on an application that contains sensitive data which can cause data breaches and can affect the company drastically. One of the leading causes of data breaches is due to unprovisioned account access.

### Let’s take an example of SCIM Process between Okta and Shopify {#Let’s take an example of SCIM Process between Okta and Shopify}

**Okta SCIM provisioning with Shopify** can be achieved by using our [**miniOrange SCIM Provisioning De-provisioning**](https://www.miniorange.com/products/user-provisioning) application. Our SCIM application is compatible with almost all the Identity Providers that support SCIM protocol and can enable secure **User Syncing from Okta into multiple Shopify stores** and vice versa.

Consider an organization with multiple Shopify stores, that uses Okta as its IDP (Identity Provider), and SCIM Application is configured across both of the platforms. Now suppose, if a new employee joins the organization, an Okta account will be created for him. If you use the **miniOrange SCIM User Syncing application**, his account will be created automatically in all of the Shopify stores, and they can be assigned a specific group/tag in the store to provide them access to specific areas of Shopify Storefront. This eliminates the need for IT Department to manually update the employee’s access rights. If an employee leaves the organization then his okta account is deleted, then the user sync functionality will restrict the employee from accessing all of the Shopify accounts. As a result, the organization’s applications are more secure, and administrative expenses and time are reduced.

In this way, with SCIM Provisioning Deprovisioning Application you get the benefit of user provisioning and deprovisioning functionality.

![shopify-scim-provisioning-manage-cloud-apps](/blog/assets/2023/shopify-scim-provisioning-manage-cloud-apps.webp)

### Key features of using SCIM with Shopify {#Key-features-of-using-SCIM-with-Shopify}

- **Automate user Deprovisioning / Deactivation:** Automatically restrict the customer from accessing the Shopify Store whenever the same user is removed/deleted from your other existing Website or Application.

- **Automate real-time provisioning:** Real-time user syncing can be achieved using the SCIM protocol. You can connect with your other website / existing Application and auto-create a user in Shopify when the user signup in your other website or Application.

- **Assign Tags to Customer:** You can assign tags to each user at the time of user creation in Shopify.
  Attribute Mapping: Map and update Shopify user attributes automatically from your IDP.

- **Two-way User Profile in Sync:** Two-way User Syncing can be achieved using SCIM protocol. Update user in Shopify whenever a user is updated in your other website and vice versa.

- **Connect multiple stores with a single application:** manage your multiple Shopify stores users from a single application (like okta, wordpress, etc.)

### Additional Benefits of Enabling SCIM in Shopify {#Additional-Benefits-of-Enabling-SCIM-in-Shopify}

- Lower repetitive and manual work
- Get deeper insights on user behavior and data
- Simplify user onboarding experience
- Save time, resources, and costs
- Automate account creation and handling
- Much higher security, much lower human error
- Reduce complexity, increase efficiency
- Automatic real-time User syncing

### Further Reading

- [Shopify SCIM Provisioning/de-provisioning features and benefits](https://plugins.miniorange.com/shopify-scim-user-provisioning)
- [Shopify Okta SCIM Provisioning and de-provisioning](https://plugins.miniorange.com/shopify-okta-scim-provisioning-guide)
- [Download and read more about the Shopify SCIM application](https://apps.shopify.com/scim-user-sync-provisioning-deprovisioning)
- [Other Security Solution for Shopify](https://plugins.miniorange.com/shopify)


Shopify SCIM provisioning enables real-time provisioning and deprovisioning of users and automates user syncing between your application and Shopify.