Jira Cloud Users & Groups Provisioning: Azure AD / Entra ID Sync Guide (REST API)

 3.1 Application Configuration

• Navigate back to the Configured Application tab on the main dashboard and click the + Add New App button.
• From the Configure Application directory screen, locate and select Azure Active Directory as your chosen provider.

• Choose your integration method. Select REST API (custom integration workflow) then click Continue.

• In the App Configuration wizard > Application Configuration section enter,

Field	Value
Application Name	A unique label for this REST API application
Client ID	The Application (client) ID from Step 3
Client Secret	The client secret Value from Step 3
Tenant ID	The Directory (tenant) ID from Step 3

 3.2 Provisioning Operations

In the Provisioning Operations section, define your synchronization settings:

• Azure AD Directory: sync all users in the tenant.
• Azure AD Enterprise Application: sync only users assigned to a specific enterprise application.
• Azure AD Groups: sync only users belonging to specific groups.

Azure AD Enterprise Application (optional)

• Enter the Enterprise Application Object ID from Azure AD to synchronize users and groups assigned to that enterprise application.
• Users and groups assigned to the specified enterprise application will be provisioned to the application.

Azure AD Groups (optional)

• Enter the names of the Azure groups from which you want to sync users.
• Press Enter after entering each group name to add multiple groups. Group names are case-sensitive.


Once this is selected, click on Next.

User Operations:

Ensure the Import Users toggle is switched ON. In the Deactivated User Action dropdown, select the action that should be taken when a user is unassigned or deactivated in Azure.

Group Operations:

• Switch to Group Operations and enable Import Groups.
• Group operations can be performed either with On-the-Fly Group Mapping or Manual Group Mapping.

1. On the Fly Group Mapping:

• Select this tab to create groups dynamically as it is from IdP to Jira Cloud if they do not exist in Jira and map the users accordingly.
• You can enable the Apply Regular Expressions on Group Names option to transform group names using Regex patterns before mapping them to Jira groups.
• Under Filter Incoming Groups, you can configure how you want to filter group names received from the provider.

2. Manual Group Mapping:

To map groups from your IdP to Jira's native groups, select this tab. When the sync executes, the users from respective groups of the IdP will be mapped to Jira groups as per configuration.

Keep Existing Groups

This setting controls how a user's Jira group memberships are managed during user provisioning and deprovisioning operations performed by the Identity Provider (IdP).

Enabled:

For any new user added to IdP groups, it will be added to Jira groups. But if users are removed from IdP groups, Jira group memberships are preserved in the Jira directory.

• Current Jira groups: jira-software-users, jira-administrators
• Groups received from Azure AD: developers, employees
• Resulting Jira groups: jira-software-users, jira-administrators, developers, employees

Disabled:

During provisioning, deprovisioning, or user unassignment, all existing Jira group memberships are removed except those specified in the Exclude Groups list. During provisioning, the user is subsequently assigned only to the groups received from the Identity Provider (IdP).

• Current Jira groups: jira-software-users, jira-administrators, support-team
• Groups received from Azure AD: developers, employees
• Excluded groups: jira-administrators
• Resulting Jira groups after provisioning: jira-administrators, developers, employees

After provisioning, the groups jira-software-users and support-team are removed because they are not received from the IdP and are not included in the exclusion list.

Exclude Groups: Use the Exclude Groups option to specify Jira groups that should never be removed during provisioning or deprovisioning operations, such as jira-administrators or org-admins. These groups will always be retained regardless of the user's group assignments in the IdP.

Scheduler Option:

To enable dynamic data synchronization at scheduled intervals, set Automate Synchronization to ON and define the processing interval by entering the desired number of days in the Synchronization Cycle (Days) field.

 3.3 Review and Save Configuration

• On the Review & Submit summary page, review your mapping details across the Application Configuration and Provisioning Operations summary tables to make sure everything looks right.
• Click the Save Configuration button in the bottom right corner.

 3.4 Run the Synchronization

• Return to the Configured App Tab.
• Click Synchronize on your Azure app.
• When the sync completes,verify the new and updated users under Jira’s user management section.
• If you set a scheduler in step 7,no manual action is needed for future syncs.

 3.5 Verification

• The app profile will appear on your main dashboard.
• Under the actions column for your new entry, run a sync (or wait for the scheduled cycle if the Scheduler is enabled).
• In Jira, navigate to User Management and confirm that users and groups from Azure appear in the directory. You can also review sync activity under the Audit Logs tab of the Plugin app.