Problem Definition

When a SCIM API key is going to expire, admins must view the API key expiration date in their provisioning settings.

Admins are not able to receive notifications about their SCIM API key expiring in other ways, like via email or in-product banners.

Suggested Solution

Send email notifications and have in-product banners/warnings in prominent places that warn admins about their SCIM API key expiring soon (ex. at 30d, 14d, 7d and 1d before the expiry). The notifications should provide clear step-by-step instructions on how to prevent downtime when rotating keys, or provide a link to documentation that does so.

Why this is important

Admins rely on provisioning for critical lifecycle management of user profiles. Even a short downtime may lead to out-of-sync issues between users and group data in the identity provider and in Atlassian Cloud. For example, a user may retain access to a Jira instance despite being deactivated in the identity provider.

Workaround

Admins must manually track the expiration of their SCIM API keys. Admins can view when their SCIM API key expires by following the instructions here.