SSO Group-to-Role Mapping vs Native Role Management: Deprovisioning Behavior in Jira Align

Access Governance Model Comparison

Jira Align supports two primary approaches for assigning system roles: native role assignment within the platform and centralized SSO/SAML group-to-role mapping via an identity provider. Both methods control access to portfolios, programs, and teams, but they diverge in how quickly and completely access is revoked when a user leaves an organization or changes responsibilities.

Deprovisioning Propagation Uncertainty

The documentation indicates that behavior differs between the two models when a user is removed from an IdP group. Native role removal appears to take effect immediately in the admin console, while SSO group mapping relies on session expiration, SCIM provisioning intervals, or manual sync triggers. This gap creates a window where a deprovisioned user might retain access to roadmaps, reports, and portfolio data until the next synchronization cycle completes.

Verification Constraints

Role names, menu labels, and admin UI locations have shifted across releases since the AgileCraft acquisition, so any observed behavior must be validated against the current version. Connector sync configuration with Jira Software adds another layer: broadly accessible programs mapped to Jira boards can expose work items even after Jira Align roles are adjusted.

• What is the measured deprovisioning latency when a test user is removed from an IdP group mapped to Jira Align roles?
• Does native role removal in the admin console revoke access faster than SSO group mapping under identical session conditions?
• Are audit log entries for access revocation distinguishable between the two governance models?