Atlassian Bitbucket SCIM guide

Atlassian supports SCIM (the protocol that lets your identity provider automatically create, update, and remove user accounts), but requires a separate Atlassian Guard subscription on top of your existing product licenses. Guard Standard costs $3-4/user/month additional, meaning a 100-person organization pays $3,600-4,800/year extra just for provisioning capabilities. The hidden complexity: Guard billing is per "managed user" across your entire Atlassian organization, not per active product license. Recent changes make this even more operationally burdensome. As of January 2025, SCIM API keys now expire after one year, requiring mandatory annual rotation. Plus, portal-only accounts (common in Jira Service Management for external users) won't support SCIM until Q2 2025, leaving a provisioning gap for customer support workflows.

Atlassian Jira supports SCIM 2.0 for automated user provisioning, but only with an Atlassian Guard subscription—an additional $3-4/user/month on top of your base Jira plan. For a 100-person team on Standard ($9.05/user/month), adding Guard means a 33-44% cost increase just to unlock basic provisioning automation. Enterprise customers get Guard included, but that's $155/user/year with an 801-user minimum—$124,355 upfront commitment. The Guard subscription requirement creates a frustrating gap for growing teams. You're paying for Jira licenses but still manually managing user accounts, group assignments, and project access. SSO with JIT provisioning helps with login, but doesn't handle deprovisioning when employees leave or group sync for project permissions. For development teams where access delays impact sprint velocity, manual provisioning becomes a bottleneck.

Atlassian Loom supports SCIM 2.0 for automated user provisioning, but only on Enterprise plans with custom pricing. This creates a significant barrier for teams on Business plans ($15-20/user/month) who need automated provisioning but can't justify Enterprise-level costs. The limitation is particularly problematic because Loom's domain capture feature can automatically add users to Enterprise workspaces, creating provisioning gaps where some users get automatic access while others require manual management. For video messaging platforms handling sensitive content, this creates a compliance risk. Teams often deploy Loom organization-wide for async communication, but without automated deprovisioning on Business plans, former employees may retain access to recorded videos containing confidential information. SSO alone doesn't solve this - you need SCIM to ensure departing users lose access immediately when removed from your identity provider.