Atlassian supports just-in-time provisioning for SAML with the following IdPs: Okta, Azure AD, Onelogin, Centrify, and Bitium as well as custom SAML configurations. Note that domain-based self signup must also be enabled on your site in order to immediately provision access to Jira or Confluence.

We also support user provisioning with SCIM for Okta, Azure AD, and Onelogin and have published our SCIM API for custom usage.

Dave Meyer
Atlassian Access Product Management

Hi jschroeder1412890939,

We're working hard to bring auto-provisioning to Access ASAP. If you're interested, we would love to have you fill out our survey about your identity provider and we will contact you when it's available: http://go.atlassian.com/access-survey (and you can share your feedback about potential features we're considering while you're at it )

Cheers,
Dave
Atlassian Access Product Management

Please up the priority on this request. This isn't just a matter convenience. It's a security concern, especially in an enterprise environment that deals in government CUI. The ability to automate steps in the deprovision process for departing employees (disabling accounts, revoking access to third-party applications, etc.) is relevant to the NIST 800-171 requirements.

Hello, ianwalsh

The just-in-time user provisioning via SAML is already supported. You can configure SAML integration in a way that creates user account on first login. You will need to allow users to join your site automatically (using a domain restriction, if desired) and setup default product access to ensure that automatically provisioned users join the site and have product license.

This ticket describes the capability to manage users and groups automatically, without relying on the SAML Just-in-time provisioning. This will be implemented using SCIM protocol to enable integration with Identity providers.

Could you explain why a SCIM API is necessary to enable auto-provisioning based on the SAML response attributes? The SAML Web SSO profile doesn't rely on any SCIM APIs and a user could be created in Atlassian Cloud simply based on attributes in the SAML response, as is done by many other cloud services utilizing SAML for SSO.

Hello ruslan.m2,

Thank you for reaching out on this feature request, the feature to make this functionality possible is actually being tracked here:

• https://jira.atlassian.com/browse/ID-6305

It's actively under development and an important feature to complement our Atlassian Access product, so stay tuned to watch that one too!

Thank you & best regards,

Rodrigo Becker
Atlassian Cloud Support

Low priority 

As Ray explained, your proposed workaround is not acceptable for my use-case neither.

We are using external IDP and need this feature in order to work and be compliant.

Self-sign up is also not ideal due to its inconsistent behavior and lack of notification to administrators.  We may not want our users to all have the same permissions or access the same applications.  New users would still have to contact their admin to have the permissions set, so why bother with self-sign up.