Microsoft Entra ID Importer for Assets (previously Azure AD Importer) syncs up to 23 object types from your tenant into Jira Service Management Assets, from users and groups to licenses, devices and conditional access policies. This guide takes you from a fresh install to a scheduled sync.
Before you start
- An active JSM Cloud Standard, Premium or Enterprise subscription.
- A Microsoft Entra ID administrator who can create an app registration and grant admin consent.
- The app installed from the Atlassian Marketplace.
1. Create an app registration
In the Microsoft Entra admin centre, create a new app registration for the importer and add a client secret to it. Note down the Tenant ID, Client ID and client secret value. You will enter all three in the importer.
2. Grant Microsoft Graph permissions
Add only the permissions for the object types you plan to import. Every permission must be of type Application (not Delegated), and an administrator must grant admin consent for it.
| Permission | Needed for |
|---|---|
User.Read.All | Users (the minimum set) |
GroupMember.Read.All | Group memberships, without nested groups |
Group.Read.All | Groups including nested (parent and child) membership |
Application.Read.All | Enterprise Applications, Application Secrets and Certificates, Classic Agents |
Device.Read.All | Devices |
Directory.Read.All | Licenses (also covers Users and Groups) |
User-LifeCycleInfo.Read.All | The employee leave date on Users |
EntitlementManagement.Read.All | Access Packages and Catalogs |
Policy.Read.All | Conditional Access Policies (beta) |
Tip: If your organisation uses nested groups, choose
Group.Read.AlloverGroupMember.Read.Allso parent and child memberships come across correctly.
3. Connect the importer
Open the importer's configuration in Jira and enter the Tenant ID, Client ID and client secret from step 1. Then pick what to bring across:
- Object types: switch on only the types you need out of the 23 supported.
- User properties: choose from Entra ID's 30+ user properties, including custom ones, so you only store what you use.
- Graph filters: use Microsoft Graph filters on Users and Groups to import just the records that matter, for example a single department.
4. Run a test import
Run a test import before your first full sync. It checks the connection, the permissions and the data model, so permission gaps show up now and not halfway through a large import.
5. Schedule the sync
When the test import passes, set an hourly or daily schedule. The importer then keeps Assets up to date without anyone needing to run it by hand. It handles tenants with 10,000+ users and groups.
Keep an eye on it
- Failure notifications tell you automatically when a scheduled import fails.
- Import status shows the current run, and you can cancel it if needed.
- Logs and audit logs show what happened during each import, which helps with troubleshooting.
Good to know
A user can have at most 20 groups mapped. If your users belong to more groups than that, consider using existing Jira groups.
