Problem Definition

Since groups synchronized to Atlassian applications can be used to assign permissions (project, space, etc), some group names from the IdP might not be easily recognized by users.

It would be interesting to an Atlassian administrator to have the ability to map groups synchronized by JIT to internal groups, with different names.

The same feature would be useful when configuring JIT with Azure AD.
Azure AD would send only the group ID (Azure Active Directory Group ObjectId) through SAML.
This feature would enable Azure AD customer to enable JIT in their instances.
More details in Configure group claims for applications with Azure Active Directory.

Note that sAMAccountName can be used for groups synchronized from on-prem AD, but not for groups created directly on Azure AD.

Suggested Solution

Provide a feature to map the name of groups synchronized from the IdP to new names.
This is similar to a feature provided by other Marketplace Apps:

• https://wiki.resolution.de/doc/saml-sso/latest/jira/further-configuration/transformations