
## Crowd User Management at your fingertips 🙌

Hello Crowd Admins!

An acronym for System for Cross-domain Identity Management, SCIM is an open standard that helps in automating the user identity lifecycle management process.

That’s the industry definition, sounds complicated! Let’s see if we can simplify it a bit with the help of this article. It’s all about ‘identity and access management (IAM),’ the concept has been around for quite some time. Think about if you are able to create a user account in one system and matching accounts automatically get created in other systems the user needs access to.

Sounds amazing but it’s not so simple as each system may have its own unique connection methods such as LDAP, SQL, ADSI, custom APIs, etc. That’s where SCIM comes into the picture, it is designed to make managing user identities in cloud-based services and applications easier, but before we go further let’s dive into…

### Why SCIM? {#why-scim}

Instead of the ‘what’ let’s begin with the ‘why.’ We use different cloud-based SaaS applications such as Salesforce, Zendesk, GitHub, Trello, etc. in our daily work routine depending on our role. These applications were assigned to us when we initially joined. This is done by the IT Admin of the company, now think for a minute if a company has less than 10 employees, manually adding them to the application might work but what if the size of the company runs into hundreds or thousands, the task becomes challenging. And, what about when an employee leaves or is terminated from the company they are removed from the company’s employee directory and all access revoked?

The crowd is the tool given by Atlassian which manages users and groups for all Atlassian apps. Crowd is a centralized directory and the access and authorization to Jira, confluence applications are very much dependent on Crowd.

We are pleased to present to you the app that aims to solve your most complex problem. Syncing & Managing users in a crowd is now a problem of the past! Introducing the miniOrange [Crowd SCIM Plugin](https://marketplace.atlassian.com/apps/1229918/mo-scim-provisioning-user-group-sync-for-crowd?hosting=datacenter&tab=overview) 🎉

The Crowd SCIM plugin connects Crowd with your Identity Provider. You can connect different Identity Providers such as Okta, Azure AD, Onelogin, Keycloak, G Suite and any SCIM Supported IDPs for provisioning. Unleash the true potential of Crowd giving you access to features like:-

**Provision & De-Provision users 🔁**

Easily provision and de-provision users in Crowd in sync with your Identity Provider.

**Update/Activate/Deactivate users ✅**

Automatically update the details of users, and activate and deactivate user accounts (If deleted or deactivated in IDP) to save extra license costs and improve the security of your organization.

**Real-Time Provision Users 🚀**

As soon as a user is created on your Identity Provider, it will automatically be created in Crowd, in REAL TIME!!!!

**IDP App-specific provisioning 🖥️**

You can choose provisioning features based on your configured IDPs. Isn’t that great?

**Transform username based on regex for matching user 🧑‍**

Do your users have different usernames in your IDP and different usernames in Crowd? We’ve got you covered. This feature will allow you to transform the username received from the IDP and create or update the desired username in Crowd.

![Crowd User Management Sync](https://miniorange.com/atlassian/wp-content/uploads/sites/14/2023/01/Crowd-SCIM.webp)

I hope you enjoy this plugin as much as we did while creating it. While this is what we’re offering now, here’s our roadmap for the next release:

-   Upcoming Features 🛣️

-   Scheduled Provisioning

-   Filter users by groups for assigning

-   Manual user sync button

-   Sync/update users upon successful authentication

Feel free to reach out to us at [atlassiansupport@xecurify.com](mailto:atlassiansupport@xecurify.com) for a free demo, setup, or any custom use case. We’re happy to help 😄

Try the miniOrange Crowd SCIM plugin today!


Use Crowd SCIM to sync your users, groups and directories with SCIM for Server/DC. Support for Azure AD, Okta, Onelogin, Oracle IDCS, ... IDPs

Crowd User Management at your fingertips


## How miniOrange SCIM Simplifies Centralized IDP User Management in Atlassian Apps

If your business relies on various Atlassian applications and services to conduct your day-to-day operations, you would certainly relate that managing user accounts and their access could be challenging and often time consuming. This is where **miniOrange’s User Sync/SCIM** App comes into play.

SCIM an acronym for ‘System for Cross-domain Identity Management’ is a protocol that allows for automated provisioning and de-provisioning of user accounts between different systems. Our app allows seamless login into the **Jira, Confluence. Bitbucket, Crowd** and other Atlassian applications with Identity Provider (IdPs) like [Azure Active Directory, Keycloak, Okta, OneLogin, Oracle and more.](https://developers.miniorange.com/docs/atlassian/scim/overview)

To get a better understanding of its use cases, let’s take Okta as the identity provider and an application, say Jira:

### New Employee Onboarding (User Creation) {#user-creation}

When we talk about user creation, we refer to the process of adding a new user account to various systems that they may require. This usually happens when a new employee joins an organization and would need access to, say for instance, a team collaboration tool (Confluence) or a project management tool (Jira), if a developer then probably a tool to effectively store, manage and monitor codes (Bitbucket).

Let’s say when a new employee joins your company, the IT administrator with user information like username, email, and other relevant details would create a new user account in Okta (IDP), and then miniOrange User Sync/ SCIM ensures that accounts created in Okta is automatically replicated in Jira, profiles and attributes are in sync between both the systems.

### Change in User Information (User Updation) {#user-updation}

User information like email address, phone number, or role may change over time, and it’s essential to keep this information updated and ensure that it is consistent in all applications. Any such changes can also be automatically updated using miniOrange User Sync/ SCIM. Admins can easily update user information in Okta and those changes would reflect in Jira.

For example, if a user changes their phone number, you can update that information in Okta and the changes would be synced in Jira so that it’s consistent with both systems.

### Revoking User Access (Deactivation) {#user-deactivation}

When an employee leaves the company their access to company resources should be removed to maintain security and compliance. It also could be the case that a user’s access to certain systems needs to be revoked based on role change. This process of deactivation is automated just like the above with the app and once a user is deactivated in Okta, SCIM App will automatically deactivate the corresponding user in Jira.

For example: if an employee leaves the company, the HR department would disable their account in Okta and the miniOrange User Sync/SCIM would then automatically disable or remove the user’s account in Jira so that their access to the application is revoked.

### Assigning Groups to Users (Group Mapping) {#assigning-groups-to-users}

![SCIM flow diagram](/blog/assets/2023/miniorange-scim-for-atlassian-apps.webp)

Another essential use case is that it enables admins to manage user access to different resources and applications based on their group, in other words, it refers to the process of associating users with specific groups. With miniOrange User Sync/SCIM, you can map users to groups in Okta and Jira. This ensures that users have the necessary access to resources based on their roles and responsibilities. Group mapping can be done manually or [on the fly](https://developers.miniorange.com/docs/atlassian/scim/user-groups).

**Manual Group Mapping** involves manually assigning users to groups in Okta and Jira. It is useful when your IdP group names and local application group names are different here you would have to map each IdP group to the application group manually.

It allows you to manually map Jira groups with the groups from Okta or filter groups, and make changes to existing users. Manual Group Mapping is useful when you want to manage groups from Okta but the group name differs in Okta and Jira.

For example, if the name of the group in Okta is Dev users but the name of a similar group in Jira is Software_dev. In such scenarios, you would have to manually map each Okta group to the Jira group.

**On-the-fly** group mapping refers to the process of dynamically mapping users to groups. For instance, when group names in Okta and Jira are an exact match, the app would detect the groups and add users to those groups automatically and if a group doesn’t exist in Jira then it would be created.

Let’s say for better clarity, you use Okta for identity and access management and Jira for project management. There are several teams working on different projects, each team has its own group with a unique name, here let us consider “Marketing” group in Okta and a “Marketing” group in Jira. When a new user joins the company, they are added to Okta, and their profile contains information about which team they belong to.

As there is an integration between Okta and Jira using the miniOrange app that supports on-the-fly group mapping. The app detects the team information from Okta and checks if a group with the same name exists in Jira. If a group with the same name exists, the user is automatically added to that group, in this case, “marketing” if not, then a new group ‘marketing’ is created in Jira and the users are added.

The above are just a few of the most common use cases but it’s not just limited to that. **Identity Migration**-moving from one IdP to another, **SSO (Single Sign-On)** can be integrated with our SCIM app, **attribute transfer** to a relying party’s website and more. That brings us to…

### How Do IT Administrators Working with Atlassian Applications Benefit? {#benefits-for-it-admins}

Our SCIM integration offers various benefits to Atlassian application users, be it **Confluence, Jira, Bitbucket, or Crowd.** It is a popular solution among IT admins for user provisioning and de-provisioning. One of the main advantages of SCIM is that it **saves licensing costs** as it automates the user provisioning and de-provisioning process. Organizations with a large number of users can reduce the number of licenses needed for applications thus saving a significant amount of money.

The addon ensures that resources are allocated more efficiently as new users are automatically provisioned with the appropriate access rights. miniOrange User Sync/SCIM allows for **granular control** so that users only have access to the resources they need thus **mitigating the risk of unauthorized access.** All leads to **enhanced security** by ensuring that user access is granted or revoked in a timely manner.

Companies can expect an **increase in productivity** as our app eliminates the need for manual user provisioning and de-provisioning so that your IT staff can focus on more critical tasks. The automated process **reduces the risk of manual errors** as well. With these benefits, your business can look to **improve the overall user experience** eventually leading to higher user satisfaction.

### Summary {#summary}

If you are here, that means you took the time to go through the use cases and the overview of our app. No more time-consuming manual onboarding and offboarding users, employees get easy and quick access to the apps they need to work. You get automated access management that not just saves you time but also money.

You could also go through our other apps that compliment ‘lifecycle management’ such as SSO that would work in tandem to keep you secure. So, set up your employees fast with what they need, and unburden your IT team to focus on the bigger picture. Looking for something specific? Please contact us at **support-atlassian@miniorange.atlassian.net** or raise a support ticket [here](https://miniorange.atlassian.net/servicedesk/customer/portal/2), and keep watching this space for more new and innovative solutions.


SCIM an acronym for ‘System for Cross-domain Identity Management’ is a protocol that allows for automated provisioning and de-provisioning of user accounts between different systems. Our app allows seamless login into the Jira, Confluence, Bitbucket, Crowd and other Atlassian.

How miniOrange SCIM Simplifies Centralized IDP User Management in Atlassian Apps


## How miniOrange User Sync/SCIM Automates User Provisioning for Atlassian DC applications {#how-miniorange-user-sync-automates-user-provisioning-for-atlassian-dc-applications}

Managing users in Atlassian manually, especially in situations with large numbers of users, is time-consuming and prone to human error. With employees joining various departments and projects on a regular basis, a lot of time is spent on managing users with the access they need which can lead to users being provisioned incorrectly.

[miniOrange User Provisioning](https://marketplace.atlassian.com/search?query=miniOrange%20User%20Sync) for Atlassian applications comes packed with a variety of powerful features. With the miniOrange User Provisioning app, employee/user accounts can be created, updated, deleted, and given proper access across multiple applications at the same time. The procedure of adding, updating, and deleting users, as well as managing their access, is automated. 

&nbsp;

![user-sync-scim](/blog/assets/2023/user-sync-scim-automate.webp)


When it comes to Atlassian products such as Jira, Confluence, and Bitbucket you can use Just-in-time provisioning provided with the Single Sign-On functionality of Atlassian Data Center. The native SSO functionality of Atlassian allows you to update the users and their groups at the time of SSO login. **However, for most enterprises, this does not fulfill the overall requirement.** 

Atlassian SSO updates users and groups only at the time of SSO (Just in Time Provisioning). 

&nbsp;
 

Most Atlassian customers implementing SAML use the attributes sent in the SAML response to provision users just-in-time. 

 &nbsp;

Using Just In Time (JIT) Provisioning, you receive all group and user information from your Identity Provider. JIT provisioning will remove any existing Jira or Confluence groups that are not in the SSO response. Managing a few groups within Jira or Confluence will never work in this scenario. **If you are manually managing some groups, that will not work with Atlassian SSO. This is one of the shortcomings of Atlassian’s provisioning model and may not be an ideal solution for Enterprises.**

&nbsp;

In this article, we will go over the top provisioning features that you won’t find in Atlassian’s inbuilt User Provisioning in Data Center – but you will find in miniOrange’s User Provisioning App. 

&nbsp;

Let’s see what the miniOrange User Provisioning app offers along with Just-in-time provisioning:
 
- **Real-time provisioning**– your user and group information will get automatically updated every time the user’s data is updated in the Identity Provider. 

- **Sync the User from a particular group or an application** – You can sync users from a particular group or application if you do not want all your users synchronized. Members from only that group will be synchronized. 

- **User Deactivation/Delete from Jira/Confluence** - According to some estimates, approximately 30% of all Atlassian user licenses are unused. This happens because users that leave the organization or change roles don’t have their accounts deactivated in a timely manner. Atlassian users whose accounts haven’t been deactivated can have negative consequences, like exceeding license limits leading to an increase in licensing costs and retaining access from former employees – posing major security concerns.

&nbsp;&nbsp;

**Just-in-Time provisioning cannot be used to deactivate the user since the SSO process involves active user accounts.** You can manually remove the user from the Jira group but it will still consume the licenses. 

With the help of our User Provisioning Add-on, you can **automatically deactivate and delete multiple users** from specific groups. Users can be automatically deleted based on their status in the directory. 

- **Synchronization of User Directories:** the miniOrange User Sync plugin can synchronize entire directories with the help of Real-time provisioning. When user directories are synchronized, new users will automatically be added in the respective Atlassian applications. With User Directory Synchronization you can also sync IDP-specific directories. You can also schedule synchronization which provides proactive provisioning and de-provisioning of users and groups at regular intervals (sync).

- **User name and Group transformation –** Native SSO provisioning requires you to provision the user with the same username as IDP. However, with username transformations, you can associate the provisioning of users with different values. Filtering groups will help you to manage access and permissions within Jira or Confluence easily.

Apart from this, the [miniOrange User Provisioning](https://marketplace.atlassian.com/search?query=miniOrange%20User%20Sync) App offers a wide range of features focusing on provisioning users from your IDP directory into Atlassian Applications. Below is the detailed comparison of the [miniOrange User Provisioning app](https://marketplace.atlassian.com/search?query=miniOrange%20User%20Sync) with native Atlassian. 

### miniOrange User provisioning Features {#miniorange-user-provisioning-features}

1. Supports SCIM 2.0 and SCIM 1.1 protocol	
2. On- the fly group mapping
3. Manual Group Mapping	
4. Default Group Mapping
5. Sync History
6. Provision to map groups from IdP to local groups

**Ready for the action? Install User Sync today!**

 &nbsp;&nbsp;

It’s really easy to manage users via our developed user provisioning add-ons which can be connected with your IDPs ([Azure AD](https://www.miniorange.com/atlassian/jira-scim-user-and-group-provisioning-for-azure-ad), [Okta](https://www.miniorange.com/atlassian/jira-scim-user-and-group-provisioning-for-okta), [OneLogin](https://www.miniorange.com/atlassian/jira-scim-user-and-group-provisioning-for-onelogin), [G suite](https://www.miniorange.com/atlassian/user-and-group-sync-user-provisioning-g-suite/), [Keycloak](https://www.miniorange.com/atlassian/user-and-group-sync-for-keycloak)) or any other SCIM compliance applications so when you setup your Jira Azure AD SCIM or Jira Okta SCIM, user sync plugin will make it a cakewalk for you. Follow the guide to quickly set it up for the Data Center version.

 &nbsp;&nbsp;
 
The add-on also works with [Single Sign On](https://marketplace.atlassian.com/search?query=miniOrange%20Single%20Sign%20On%20) where SSO is used for authentication and User sync application is used for automatic provisioning.


&nbsp;&nbsp;


Contact Us – Drop us a mail at **info@xecurify.com** or [raise a ticket here](https://miniorange.atlassian.net/servicedesk/customer/portal/2) to talk to us.





Managing users in Atlassian manually, especially in situations with large numbers of users, is time-consuming and prone to human error. With employees joining various departments and projects on a regular basis, a lot of time is spent on managing users with the access they need which can lead to users being provisioned incorrectly.

How miniOrange User Sync/SCIM Automates User Provisioning for Atlassian DC applications


## Jira Cloud SCIM/User Sync: Embrace Multiple IDPs and Customer Sync Freedom for Individual Applications {#jira-cloud-scim-user-sync}

&nbsp;

Is your business facing the challenge of synchronizing customer data along with integrating multiple identity providers (IDPs) for sync? Atlassian users look no further than our user management plugin [‘Jira Cloud SCIM/User Sync’](https://marketplace.atlassian.com/apps/1222000/mo-scim-provisioning-user-sync-group-sync-for-jira?hosting=cloud&tab=overview) which redefines the process, while seamlessly managing user identities and data synchronization.

&nbsp;

Let’s delve into the features of this groundbreaking plugin and see how it empowers enterprises to overcome the tedious task of synchronizing users/groups from multiple IDPs and streamlining customer data across multiple platforms.

&nbsp;&nbsp;

### Seamless Integration with Any IDP {#seamless-integration-with-any-idp}

&nbsp;

We begin with one of the key features, its ability to seamlessly integrate with any identity provider for synchronizing users. Whether your business relies on popular providers like Okta, Azure, or miniOrange, or you have a custom-built IDP, this plugin eliminates the hassle of performing different CRUD and User provisioning operations based on systems. It provides a unified interface for user provisioning, enabling developers to focus on building innovative applications rather than worrying about IDP compatibility.

&nbsp;

For instance, if an organization has customer identities managed in multiple Azure directories or in different entities like Okta and Azure AD, it would be a headache to manage these Identities at the same time on the Enterprise level. However, you can leverage our plugin to consolidate your user provisioning process and utilize both Azure and Okta simultaneously without having to choose one over the other and provide a seamless user experience across multiple applications..

&nbsp;&nbsp;


### Independent Application Development {#independent-application-development}

In the past, managing multiple users and groups manually has been a complex and time-consuming task. However, our plugin offers a solution that allows businesses to develop applications that are not limited to a single IDP or a specific method of customer and user synchronization. It provides flexibility and independence in integrating with different systems..

&nbsp;

For example, multiple SCIM connections (System for Cross-domain Identity Management to System for Cross-domain Identity Management): In this scenario, our plugin enables an application to synchronize user data between two or more IDPs that support the SCIM protocol. The application can retrieve user information from one SCIM-based IDP and synchronize it with another SCIM-based IDP.

&nbsp;

Likewise, you can create multiple connections for the SCIM or the REST API Connectors or a combination of both, while maintaining a unified user experience across different platforms.

### Flexible Customer Sync Options {#flexible-customer-sync-options}

When businesses use multiple applications, it's important for them to keep their customer data synchronized, meaning that the data is consistent and up-to-date across all the applications they use. Our plugin for JIRA makes it easy to manage this synchronization process. It gives you a lot of flexibility and customization options. You can decide how you want the synchronization to happen.


&nbsp;

For example, you can choose to sync the data in real-time, meaning it happens instantly as changes are made. Alternatively, you can do a group sync, where the data is synchronized in groups at specific intervals, control access to portals based on IDP groups and organizations. You can even choose to manually sync the data when you want. This flexibility ensures that your customer data stays current in all your applications, without affecting performance or the experience of your users.

### Enhanced Security and Privacy {#enhanced-security-and-privacy}

When we deal with user identities and sensitive customer data, our top priority is to ensure security and privacy. Our plugin is designed to ensure that the right people have appropriate access to your system. By implementing granular access levels, we provide a robust user management solution that allows you to assign and control permissions with precision.

&nbsp;

Administrators are empowered with comprehensive control, while users can perform advanced tasks within predefined boundaries. You can confidently regulate access and safeguard sensitive resources, ensuring that only authorized individuals can interact with them.

&nbsp;

By implementing these measures, we aim to maintain the highest level of security for user data throughout the entire process.

### Wrapping It Up {#wrapping-it-up}

With seamless IDP integration, Jira Cloud SCIM/User Sync offers a powerful solution for organizations seeking to enhance their user management capabilities. By integrating with your Identity Provider (IDP), it streamlines the user provisioning and management processes, ensuring a seamless experience for both administrators and end-users.

&nbsp;
By leveraging the SCIM functionality to Jira cloud, you can focus on delivering exceptional user experiences. With streamlined user management processes, you can devote more time and resources to building engaging applications and features that delight users. Our solution puts you in control by seamlessly integrating with multiple IDPs and facilitating customer sync, allowing you to maintain governance over your applications and data.

&nbsp;

To learn more about [Jira Cloud SCIM/User Sync](https://marketplace.atlassian.com/apps/1222000/mo-scim-provisioning-user-sync-group-sync-for-jira?hosting=cloud&tab=overview) or if you have specific inquiries, you can contact us at **support-atlassian@miniorange.atlassian.net** or raise a support ticket [here](https://miniorange.atlassian.net/servicedesk/customer/portal/2). Stay tuned to this space for more new and innovative solutions as we continue to enhance our offerings and deliver cutting-edge solutions to meet your evolving needs.


Contact Us – Drop us a mail at **info@xecurify.com** or [raise a ticket here](https://miniorange.atlassian.net/servicedesk/customer/portal/2) to talk to us.





Unlock exceptional user experiences while maintaining control over applications and data with Jira Cloud SCIM/User Sync. Seamlessly integrate your Identity Provider, develop custom applications, sync customer data, and enjoy enhanced security measures.

Jira Cloud SCIM/User Sync: Embrace Multiple IDPs and Customer Sync Freedom for Individual Applications


## User Provisioning App : Keeps you in sync with multiple Atlassian applications! {#keeps-you-in-sync-with-multiple-atlassian-applications}

[Advanced Option for Atlassian SSO Plugin](https://marketplace.atlassian.com/apps/1229209/advance-options-for-atlassian-sso?hosting=datacenter&tab=overview)

Picture this: You have 1000s of users. Each user accesses multiple atlassian applications like Jira and Confluence and some of them keep facing issues with user access, activation and deletion which by the time you resolve, you have another pile waiting for you. Sounds familiar? 

&nbsp;&nbsp;

How are you going to manage user provisioning and de-provisioning and access of every user for each application? Manually managing large numbers of users is equivalent to putting out fires all day long. We’ve got you covered with our User Provisioning /SCIM add-on, which can help you to handle your users/employees instantly and effortlessly across atlassian applications for Jira SCIM and Confluence SCIM. Wondering how is it possible? We will help you to understand exactly how it can be done.

### What is User Provisioning and Deprovisioning? {#user-provisioning-and-deprovisioning}

User Provisioning is the process of creating, updating and/or deleting a user’s account and access through multiple applications at once. In our particular case this user sync or SCIM can be applied to Atlassian applications for Jira User Sync and Confluence User Sync. Provisioning provides information about users / employees such as their name, attributes, groups and other relevant data allowing them to grant or revoke access as required. Some of the real time examples like hiring, promotions, transfers can set off provisioning. Provisioning ensures user’s access rights are up to date, without manual efforts for each user across all applications.

&nbsp;&nbsp;


### Why is User Provisioning / Deprovisioning important? {#Why-is-user-provisioning-deprovisioning-important}

- Automatically create, update, deactivate or activate user accounts across applications.
- Saves time, manages users directory at one place and keeps everything else sync with directory.
- Automatically assign role-based permissions within apps
- Ensure the prevention of unauthorized access by automatically revoking access to all apps at once – de-provisioning.

### Ready for the action? Install User Sync today! {#ready-for-the-action-imstall-user-sunc-today}

- It’s really easy to manage users via our developed user provisioning add-ons which can be connected with your IDPs (Azure AD, Okta, OneLogin,G suite, Keycloak) or any other SCIM compliance applications so when you setup your Jira azure AD SCIM or Jira Okta SCIM, user sync plugin will make it a cakewalk for you. Follow the guide to quickly set it up for the Server or Data Center version.
- The add-on also works with Single Sign On where SSO is used for authentication and User sync application is used for automatic provisioning.

 
Contact Us – Drop us a mail at **info@xecurify.com** or [raise a ticket here](https://miniorange.atlassian.net/servicedesk/customer/portal/2) to talk to us.





User Provisioning is the process of creating, updating and/or deleting a user’s account and access through multiple applications at once. In our particular case this user sync or SCIM can be applied to Atlassian applications for Jira User Sync and Confluence User Sync.