Atlassian SCIM provisioning (Jira, Confluence) from Google Workspace

Atlassian Cloud accepts SCIM through user provisioning in Atlassian Guard. You create an identity provider directory in Atlassian Administration, which gives you a directory base URL and an API key. AnySCIM then syncs users and groups from Google Workspace, and the groups decide who gets Jira, Confluence and other products.

Requirements

• An Atlassian Guard subscription (formerly Atlassian Access) on your organization.
• A verified domain in Atlassian Administration: only users with an email on a verified domain can be provisioned.
• Organization admin rights in admin.atlassian.com.

Create the directory and API key

1. In admin.atlassian.com, go to Security → Identity providers.
2. Add an identity provider directory and choose Other provider as the type.
3. Open Set up user provisioning. Atlassian shows the directory base URL and an API key.
4. Copy both now: the API key is shown only once.

Connect Atlassian in AnySCIM

1. Open Connections → New connection and choose Atlassian.
2. Paste the directory base URL. It looks like https://api.atlassian.com/scim/directory/{directory_id}.
3. Paste the API key as the bearer token and click Test connection.
4. In Scope, select the groups that need Atlassian products and turn on Push group membership.
5. Review the dry-run and activate.

Grant product access with groups

Provisioned groups appear in Atlassian Administration as synced groups. Give each group product access (for example, add eng@acme.com to Jira Software users and Confluence users). From then on, joining the Google group is enough to get the products, and leaving it removes access.

How users are synced

• Users are matched by email (userName). Existing Atlassian accounts on your verified domain are linked rather than duplicated.
• A suspended Google user is sent as active: false, which deactivates the Atlassian account and frees the product seats.
• Synced groups are managed by the directory and become read-only in Atlassian, so membership changes must happen in Google.

Troubleshooting

• 401: the API key was regenerated or the directory was deleted. Create a new key and update the connection.
• User rejected on create: the email domain is not verified in Atlassian Administration.
• Users exist but cannot open Jira: the synced group has not been given product access.

FAQ

Do I need Atlassian Guard for SCIM?

Yes. User provisioning from an external identity provider is part of Atlassian Guard (previously called Atlassian Access).

Can I manage Jira and Confluence access from Google groups?

Yes. Push the groups with AnySCIM, then grant product access to the synced groups once in Atlassian Administration.

What happens to content when a user is deactivated?

Deactivation removes access and frees the license, but issues, pages and comments created by the user stay in place.