Understand how to build an allocation policy
Who can do this? |
Your identity provider provisions users and groups to your organization. Allocation policies give you a rules-based way to decide which units receive them. For example, you might want to allocate a Finance group to a Finance unit.
Allocation is separate from connecting your identity provider, so set up user provisioning before building an allocation policy.
Understand how a policy is set up
To set up an allocation policy, define conditions for the matches, and select destination units:
Set your conditions.
Choose your units.
Every policy needs at least one condition and one destination unit. A policy applies to every provisioned user and group that meets its conditions, including those you’ve already provisioned.
You can save a policy as a draft or activate it, and change its state later. A draft policy doesn’t add anyone. When you activate a policy, matching users and groups are added to its destination units. This might take a few minutes.
Choose your scope
By default, policies apply to your Atlassian organization. You can’t limit it to specific identity provider connections at the organization level; identity provider connections can only be specified at the condition level.
Set your conditions
Conditions describe which provisioned users and groups the policy applies to.
Start with one policy and a narrow condition, such as a single group, so you can check the results before you add more policies.
Matching isn’t case-sensitive.
To allocate specific people, create a group for them in your identity provider and allocate that group.
Condition | What it checks | Applies to |
|---|---|---|
Identity provider | Whether the user or group was provisioned from a specific identity provider connection. | Users and groups |
Domain | The domain of the user's primary email, for example | Users only |
Group name | The exact name of a group synced from your identity provider. | Groups |
Group name pattern | Group names that start with, end with, or contain a value, for example | Groups |
How are users and groups allocated?
Policies only add people. When a user or group matches a policy, they're added to that policy's units. A policy can't stop anyone from joining a unit. When a group matches a policy, all members who belong to that group get added to the unit.
Matches across policies add up. If a user or group matches more than one policy, they're added to the units from every policy they match. Policies don't run in any order, and none takes priority over another.
Policies don't cancel each other out. If two policies add people to the same unit, both apply. One policy can't stop another from adding people.
Policies never remove people. If a user or a group stops matching a policy, they stay in the unit they joined another way, for example through a different policy or through user invites. This doesn’t delete or suspend their account.
For units that were created during the units open beta, we’ll create allocation policies if you’re already provisioning users and groups using an identity provider. These policies will add all your provisioned users and groups to your existing units, so no one loses access. To limit who's in an existing unit, edit these policies.
Say you've synced users from your identity provider for a while, and you now want your Finance unit to include only your finance group. Edit the allocation policy we created for your existing units so it matches only the finance group.
Choose your units
Select the destination units for matching users and groups. Multiple policies can allocate to the same unit.
Review policy
Check the policy’s conditions and destination units before you activate it. There’s no preview of allocation changes before you save.
Because policy changes affect users and groups you’ve already provisioned, check the users and groups in the destination units after you activate or change a policy. Changes can take a few minutes to appear.
If a group can't sync because of a conflict, see Resolve group conflicts when syncing users.
Was this helpful?