SCIM provisioning fails with HTTP 400 when Atlassian group contains app/service accounts (4384145)

When provisioning group memberships to Jira or Confluence via Starling Connect (SCIM), the provisioning fails with HTTP 400 (BadRequest) for groups that contain Atlassian app/service accounts as members.

The following error is observed in the Job Queue:

[1777124] Error running synchronization step (Group) of synchronization configuration (Provisioning (Provisioning)).[1777004] Method (Update object (Update)) could not be run successfully.Error returned: Server returned error (HTTP BadRequest: BadRequest). URI : https://connectsupervisor.cloud.oneidentity.eu/.../scim/Groups/group-name

The issue only affects groups that contain Atlassian app/service accounts (created by marketplace add-ons and automations). Groups with only regular user accounts are not affected.

Atlassian includes app/service accounts in SCIM GET responses for group members. These accounts appear as regular users with type "User" in the member list.

When Identity Manager provisions a membership change, it reads the current group members (GET), adds the new member to the list, and sends a PUT request with the full member list.

Atlassian rejects this request with HTTP 400 because the app/service account IDs are not valid user entities for write operations.

Option A - Create dedicated provisioning groups (recommended):

1. Log into the Atlassian Admin Console at https://admin.atlassian.com
2. Go to Directory > Groups
3. Create a new group for Identity Manager provisioning (for example: "jira-software-users-managed")
4. In Atlassian Admin, assign the same product access to the new group as the original group has (Settings > Products > Product access > select the product > add the new group)
5. Open the Identity Manager Synchronization Editor
6. Open the synchronization project for your Atlassian/Starling Connect target system
7. Go to the mapping configuration for Groups
8. Add a filter or scope condition to exclude the problematic groups (e.g., exclude "jira-software-users") from provisioning
9. Update the Identity Manager configuration to provision memberships to the new group instead
10. Run a test provisioning for one user to verify it completes without errors
11. Verify the user appears in the new group in Atlassian Admin Console

Option B - Remove app accounts from affected groups:

1. Log into the Atlassian Admin Console at https://admin.atlassian.com
2. Go to Directory > Groups
3. Open the affected group (e.g., "jira-software-users")
4. Review the Members list
5. Identify members that are app/service accounts - they typically have generic names like "Atlassian Add-ons", "Automation for Jira", or other system/add-on names
6. Click Remove next to each app/service account
7. Repeat steps 3-6 for each affected group
8. In Identity Manager, re-trigger the provisioning job for the affected group
9. Verify in the Job Queue that the group update completes successfully
10. Verify in Atlassian Admin that the new member appears in the group

Note: Removing app accounts from groups may affect marketplace add-on functionality if those add-ons rely on group membership for permissions.

Test with one group first before making changes to all affected groups.