An Atlassian Guard Entra ID integration is the cleanest way to make Microsoft Entra ID the single source of truth for who can use Jira and Confluence. Done well, new hires get access on day one and leavers lose it the same day. Done poorly, it creates duplicate accounts, orphaned groups, and audit findings. This guide covers the setup order, the settings that matter, and how to prove access is reviewed.
What Atlassian Guard and Entra ID each do
Atlassian Guard, formerly Atlassian Access, is the subscription that unlocks enterprise identity controls for Atlassian Cloud. Guard Standard includes enforced single sign-on, SCIM automated user provisioning, API token controls, and the organization audit log. Guard Premium adds data classification, anomalous activity detection, content scanning, and SIEM integrations.
Microsoft Entra ID, formerly Azure Active Directory, holds the identities and groups. It signs users in through SAML single sign-on and pushes users and groups to Atlassian through SCIM 2.0. Also note that some Microsoft documentation still uses the older Atlassian Access name.
| Capability | Where it is configured | What it controls |
|---|---|---|
| SAML single sign-on | Entra enterprise app and Atlassian identity provider directory | How users authenticate |
| SCIM provisioning | Entra provisioning and Atlassian identity provider directory | Who has an account and which groups they belong to |
| Product access | Atlassian administration | Which synced groups can use Jira, Confluence, and other apps |
| Authentication policies | Atlassian administration | Which managed users must sign in through single sign-on |
| Access reviews | Microsoft Entra ID Governance | Periodic confirmation that group members still need access |
Prerequisites for an Atlassian Guard Entra ID setup
- An Atlassian Guard Standard subscription on your Atlassian Cloud organization.
- Organization admin rights in Atlassian, plus admin rights on at least one Jira or Confluence site.
- One or more verified domains. Atlassian only accepts provisioning updates for users on verified domains.
- An Entra role such as Cloud Application Administrator or Application Administrator to configure the enterprise application.
- Test users and test groups in Entra, so existing users do not lose access during setup.
Recommended setup order
Above all, order matters. Most problems we see come from turning on provisioning before deciding how groups map to product access.
- Step 1: Prepare the directory. Verify your domains and add an identity provider directory in Atlassian Administration. Then link the verified domains to it.
- Step 2: Configure single sign-on. Use the Atlassian Cloud application from the Entra gallery and test with a pilot group. Only after that, enforce single sign-on through an authentication policy.
- Step 3: Turn on SCIM provisioning. Copy the SCIM base URL and API key from Atlassian into the Entra provisioning settings. Store both securely, because Atlassian does not show them again.
- Step 4: Scope provisioning. Assign groups to the enterprise application, or use a scoping filter. Start small and use on-demand provisioning to validate a few users first.
- Step 5: Grant product access to synced groups. Synced groups do not grant access by themselves. An admin must add each group to product access.
- Step 6: Expand in waves. Add departments one wave at a time. After each wave, check the provisioning logs for errors.
Settings that cause the most trouble
- Email matching. Entra matches Atlassian accounts by email. The mail attribute is filled only for users with an Exchange mailbox, so map another attribute for users without one.
- Group renames. Atlassian Cloud does not support group renames pushed from Entra. Therefore, treat group display names as permanent.
- Unverified domains. Contractors on unverified domains will not receive provisioning updates. Decide whether to verify their domain or manage them as external users.
- Bitbucket and Trello. Group sync works for Jira and Confluence. However, it is not yet available for Bitbucket or Trello.
- Key expiry. SCIM API keys created or regenerated since early January 2025 expire after one year. Put the renewal date on the calendar, since provisioning stops when the key expires.
Deprovisioning and access reviews that hold up to audit
For regulated organizations, the most important control is deprovisioning. When a user is disabled in Entra or removed from the assigned groups, the provisioning service disables the account in Atlassian. As a result, an exit recorded in the HR system flows through to Jira and Confluence without a manual ticket.
Access reviews close the remaining gap. Microsoft Entra access reviews can cover group membership and access to enterprise applications. Reviewers can therefore certify the groups that grant Jira and Confluence access. This feature requires Microsoft Entra ID Governance or the Microsoft Entra Suite, although some capabilities may run with Entra ID P2. Meanwhile, the Atlassian organization audit log provides supporting evidence of admin changes.
In short, keep one rule: access is granted by group in Entra, never by hand in Atlassian. As a result, reviews stay meaningful and evidence simple. The same group hygiene also pays off in Microsoft 365, as our Copilot readiness checklist explains.
Frequently asked questions
Do we need Atlassian Guard to use Entra ID single sign-on?
Yes. Enforced single sign-on and SCIM user provisioning for Atlassian Cloud are Atlassian Guard features. Guard Standard includes both.
Does Entra support nested groups with Atlassian?
Atlassian publishes separate guidance for nested groups with Entra ID. Review it and test your group design with a pilot before a full rollout.
What happens to existing Atlassian accounts when provisioning starts?
Entra matches existing accounts by email address. After that, you manage their attributes and group membership in Entra. This is why test accounts and a pilot group come first.
How VTPMO can help
VTPMO is a Microsoft Solution Provider, and our team includes Atlassian Certified Professionals. We plan and run Entra ID and Atlassian Guard integrations for teams in financial services, healthcare, and government. See our Microsoft services and Atlassian cloud migration services, or contact us to plan your identity cutover.
Sources
- Microsoft Learn: Configure Atlassian Cloud for automatic user provisioning
- Microsoft Learn: How application provisioning works in Microsoft Entra ID
- Microsoft Learn: What are access reviews?
- Atlassian Support: Configure user provisioning with an identity provider
- Atlassian Support: Understand Atlassian Guard
- Atlassian: Atlassian Guard plans and pricing