Confluence Using SCIM User And Group Provisioning For Microsoft Entra ID (Previously known as Azure AD)

User Sync & Group Sync app provisions user and group information from Microsoft Entra ID (Previously known as Azure AD) to Confluence. Users, groups and directory details can by provisioned using SCIM and REST API. SCIM provisioning works based on events performed on IDP. This way the administrator only needs to manage user accounts in Microsoft Entra ID (Previously known as Azure AD).
This reduces the administration time required to create users and groups in Confluence modules such as Confluence.


You can refer the steps to configure Microsoft Entra ID (Previously known as Azure AD) method with the Confluence SCIM from the video or documentation given below


Download And Installation



  • Log into your atlassian instance as admin.
  • Navigate to the settings menu and Click Manage Apps.
  • Click on Find new apps .
  • Locate miniOrange User and Group Sync app.
  • Click Try free to begin a new trial or Buy now to purchase a license.
  • Enter your information and click Generate license when redirected to MyAtlassian.
  • Click Apply license.

Step 1: Get SCIM Client Details

  • In the Configuration tab, please select Microsoft Entra ID (Previously known as Azure AD) provider.
    • Select Azure AD as SCIM Provider
  • In the popup, please select SCIM method to perform user and group synchronization.
    • Select SCIM as Usersync method
  • In SCIM configuration, Please enter App Name and click on Save Settings button. Copy the SCIM Base URL and SCIM Bearer Token, these will be used later to configure SCIM application on Microsoft Entra ID (Previously known as Azure AD).
    • SCIM Configuration Details

Step 2: Setup Microsoft Entra ID (Previously known as Azure AD) SCIM Configurations

  • Log in to your Microsoft Entra ID (Previously known as Azure AD) portal and select the Microsoft Entra ID Directory. Then create an Enterprise application.
    • User provisioning with Azure AD of SCIM Standard - Login to Azure AD portal
  • Click on New Application and select non-gallery application.
    • User provisioning with Azure AD of SCIM Standard - In Azure AD portal Add new application
  • Give suitable name to your user provisioning application.
    • User provisioning with Azure AD of SCIM Standard Applicaiton Name SCIM_User_provisioning
  • Click on Provisioning in left menu and click on Get started.
    • User provisioning with Azure AD of SCIM Standard- Provisioning screen to manage user account
  • Select Automatic in Provisioning Mode and Enter SCIM Base URL, SCIM Bearer Token (which you will find in step 1) .
    • User provisioning with Azure AD of SCIM Standard chose Provisioning Mode Automatic
  • Assign users to your applicartion. Assigned users will be created in your Atlassian module if they are not already present. You can also assign groups. Member of assigned groups will be provisioned for Atlassian module.
    • User provisioning with Azure AD of SCIM Standard Assign users and groups to application
  • Once done with configuration, Go back to application and click on Start provisioning.
    • User provisioning with Azure AD of SCIM Standard Start Provisioning option

3: LDAP Sync Settings

  • The miniOrange user sync app now provides support for LDAP Sync. Follow the instructions to configure the LDAP directory. By configuring the LDAP directory, you can synchronize all attributes from your LDAP directory and choose the attributes you wish to include in Confluence.
    • LDAP sync in user and gruop provisioning in Jira, Confluence, Bitbucket User Sync
  • Once you have successfully configured the LDAP directory in Confluence, you can test the specific user’s attributes by using the Test Sync button.
    • LDAP sync configuration in user and gruop provisioning in Jira, Confluence, Bitbucket User Sync
  • To test your configuration, enter an username(sAMAccountName) from your directory's user data and click on the Search User button. You will then be able to view the details of the searched user.
    • LDAP sync test in user and gruop provisioning in Jira, Confluence, Bitbucket User Sync

4: User Sync Settings

  • Select the User Sync Settings tab from the left sidebar. Here you can configure different settings about user creation and updation.
    • User and gruop provisioning in Jira, Confluence, Bitbucket User Sync
  • You can select the directory, enable or disable user import, update process.
  • The user can be automatically enabled or disabled here based on IDP configuration.
  • You also have an option to set Default Project Lead and Default Component Lead.
  • Attribute mapping enables you to map your attributes sourced from the IDP to Confluence attributes. Through this section you can map your Confluence attributes to the attributes coming from IDP. By default, username attribute corresponds to the username/userPrincipalName attribute, email corresponds to the email/mail attribute, and displayName corresponds to the full name attribute. However, if you want to map these Confluence attributes with other attributes coming from IDP, you can use this feature to change the attribute mapping configurations.
    • Attribute Mapping using user and gruop provisioning in Jira, Confluence, Bitbucket User Sync
  • User sync also supports mapping of custom attributes. Here, you can create custom attributes and automatically assign values to them from the IDP (Identity Provider). Select the desired attributes from the IDP that you want to display in Confluence and provide a name for the custom attributes to be shown in Confluence.
    • Custom Attribute Mapping with user and gruop provisioning in Jira, Confluence, Bitbucket User Sync
  • Custom fields will be displayed in the user profile section as shown below
    • Custom Attributes in user and gruop provisioning in Jira, Confluence, Bitbucket User Sync

5: Group Sync Settings

  • Select the Group Sync Settings tab from the left sidebar. Here you can configure different settings about group creation and group mapping.
    • User and gruop provisioning in Jira, Confluence, Bitbucket Group Sync
  • Here you can configure Default groups for new and all users.
  • You can set Manual Group Mapping or On-The Fly Group Mapping.

    • 1. Manual Group Mapping -

    • Here you can manually map Confluence groups with the groups from IDP.
    • You can also configure to import IDP groups, filter groups and whether to keep existing users or not.
    User and gruop provisioning in Jira, Confluence, Bitbucket Manual Group Mapping

    2. On-The Fly Group Mapping -

    • Here users will be assigned to groups in Confluence whose group name is the same as groups from IDP. If the group doesn't exist in Confluence then it will be created.
    • You can configure to keep the existing user groups, filter groups and apply regular expressions on the groups.
    User and gruop provisioning in Jira, Confluence, Bitbucket On The Fly Group Mapping

6: Synchronization Process

  • To perform user sync, click on the Synchronize option of your newly created app.
  • When the synchronization is complete, you will be able to view newly created and updated user information in Confluence's User Management section.
User and gruop provisioning in Jira, Confluence, Bitbucket Synchronize

7: Multiple IDPs

  • The plugin allows for configuring SCIM provisioning on your Confluence to accommodate your specific use case. To add another IDP, simply navigate to the "Configured IDPs" section. Select on Add new App to configure multiple provisioning connections.
    • User and gruop provisioning in Jira, Confluence, Bitbucket Manual Group Mapping

Recommended Add-Ons

Two Factor Authentication

Enable 2FA/MFA for users & groups and let users configure 2FA during their first login.

Know More

Jira SAML SSO

Jira SAML SSO application enables SSO for Jira Software and Jira Service Desk.

Know More

Jira OAuth/OIDC SSO

Secure your Jira Service Management with OAuth/OpenID Connect SSO.

Know More


Free Trial

If you don't find what you are looking for, please contact us at support-atlassian@miniorange.atlassian.net or raise a support ticket here.