SSO Group-to-Role Mapping vs Native Role Management: Deprovisioning Behavior in Jira Align

Deprovisioning Latency and Behavior

Native role removal in the Jira Align admin console is faster and more immediate than SSO group-to-role mapping. Because native assignments are modified directly within the platform's database, access is typically revoked upon the user's next request or page refresh.

In contrast, SSO group-to-role mapping is generally evaluated during the authentication event. If a user is removed from an Identity Provider (IdP) group, they often retain their mapped roles until their current session expires or is manually invalidated. This creates a security gap where a deprovisioned user maintains access to portfolios and roadmaps despite no longer belonging to the required IdP group.

Likely Explanations for Latency

The difference in revocation speed is driven by the underlying authentication architecture:

• SAML Assertions: Standard SAML assertions are passed at login. Jira Align does not typically re-validate group membership with the IdP for every single click during an active session.
• SCIM Intervals: If SCIM (System for Cross-domain Identity Management) is configured, deprovisioning depends on the IdP's push interval. Some providers push changes in near real-time, while others operate on scheduled batches.
• Session Persistence: Without a Single Logout (SLO) trigger, the platform relies on the session timeout policy to force a re-authentication and a subsequent role re-evaluation.

Verification Steps

To measure the actual latency in your specific environment, perform the following tests with a dedicated test account:

1. SSO Test: Map a role to an IdP group → Log in as the test user → Remove the user from the IdP group → Attempt to access a restricted roadmap while the session is still active.
2. Native Test: Assign a role natively in the admin console → Log in as the test user → Remove the role in the admin console → Attempt to access the same roadmap.
3. Audit Review: Compare the audit logs. Native changes are usually attributed to the admin who performed the action, whereas SSO/SCIM changes may be attributed to a system or integration identity.

Critical Constraints

Note that Jira Align roles are distinct from Jira Software permissions. Removing a user's role in Jira Align does not automatically revoke their access to the underlying Jira Software boards or work items. This residual access must be managed separately within Jira Software or via your global IdP policy.

Diagnostic Detail Required: Are you utilizing SCIM for automated provisioning, or relying solely on SAML assertions at login? This determines whether the latency is tied to a sync interval or strictly to session expiration.