---
title: "Cloud: Allowing Atlassian Admins control of IDP synced Users"
canonical: "https://www.techtime-initiative.com/space/UM/334069761/Cloud%3A%20Allowing%20Atlassian%20Admins%20control%20of%20IDP%20synced%20Users"
format: markdown
---
## Challenge:

When you connect Atlassian cloud to an external Identity Provider (IDP), you cannot change the memberships of synced groups. This becomes a challenge when the groups provide access and licenses to Atlassian products, since to remove access now requires a request to the team that manages the external directory.

## Solution

- Create a regular (not synced) group for each group you would like to control. e.g (*jira-access)*
- Create a group which will contain all of the users you don’t want synced to the access group (*excluded-users*)
- Create a “Scheduled Action” which adds the members of the synced group to the not synced group
  - Exclude the group *excluded-users*
- Create another Scheduled Action which removes any members of the not synced group, that are not present in the synced group
- Remove product access from the synced group, and add it to the group *jira-access*

Now, to remove a users access - you can remove them from *jira-access* and add them to *excluded-users*

## Demo

[https://www.loom.com/share/801fe23064bc496c9792f02ecd6d9a98](https://www.loom.com/share/801fe23064bc496c9792f02ecd6d9a98)