# Atlassian SCIM provisioning (Jira, Confluence) from Google Workspace

> Sync Google Workspace users and groups to Jira and Confluence with Atlassian Guard user provisioning: directory URL, API key and setup.

**Atlassian Cloud accepts SCIM through user provisioning in Atlassian Guard.** You create an identity provider directory in Atlassian Administration, which gives you a directory base URL and an API key. AnySCIM then syncs users and groups from Google Workspace, and the groups decide who gets Jira, Confluence and other products.

## Requirements

- An **Atlassian Guard** subscription (formerly Atlassian Access) on your organization.
- A **verified domain** in Atlassian Administration: only users with an email on a verified domain can be provisioned.
- Organization admin rights in [admin.atlassian.com](https://admin.atlassian.com).

## Create the directory and API key

1. In [admin.atlassian.com](https://admin.atlassian.com), go to **Security → Identity providers**.
2. Add an identity provider directory and choose **Other provider** as the type.
3. Open **Set up user provisioning**. Atlassian shows the **directory base URL** and an **API key**.
4. Copy both now: the API key is shown only once.

## Connect Atlassian in AnySCIM

1. Open **Connections → New connection** and choose **Atlassian**.
2. Paste the directory base URL. It looks like `https://api.atlassian.com/scim/directory/{directory_id}`.
3. Paste the API key as the bearer token and click **Test connection**.
4. In **Scope**, select the groups that need Atlassian products and turn on **Push group membership**.
5. Review the dry-run and activate.

## Grant product access with groups

Provisioned groups appear in Atlassian Administration as synced groups. Give each group product access (for example, add `eng@acme.com` to Jira Software users and Confluence users). From then on, joining the Google group is enough to get the products, and leaving it removes access.

## How users are synced

- Users are matched by email (`userName`). Existing Atlassian accounts on your verified domain are linked rather than duplicated.
- A suspended Google user is sent as `active: false`, which deactivates the Atlassian account and frees the product seats.
- Synced groups are managed by the directory and become read-only in Atlassian, so membership changes must happen in Google.

## Troubleshooting

- **401:** the API key was regenerated or the directory was deleted. Create a new key and update the connection.
- **User rejected on create:** the email domain is not verified in Atlassian Administration.
- **Users exist but cannot open Jira:** the synced group has not been given product access.

## FAQ

### Do I need Atlassian Guard for SCIM?

Yes. User provisioning from an external identity provider is part of Atlassian Guard (previously called Atlassian Access).

### Can I manage Jira and Confluence access from Google groups?

Yes. Push the groups with AnySCIM, then grant product access to the synced groups once in Atlassian Administration.

### What happens to content when a user is deactivated?

Deactivation removes access and frees the license, but issues, pages and comments created by the user stay in place.