Basically the same issue as
FE-871 – Bamboo adds all users that are "visible" through Crowd, and Crowd is exposing every user, not just the users in the allowed group. We have ~4000 users in the directory and ~30 that are setup to be visible to Bamboo. After integrating Bamboo with Crowd, Bamboo added all 4000 users. It should only add users that are authorized to use Bamboo.