Minimizing Data Exposure During User Import and Sync with Entra ID for IDE Services On-Premises – Support | JetBrains

Background/Situation

Due to security compliance concerns, the user wants to minimize data exposure when importing and synchronizing groups from Microsoft Entra ID to JetBrains IDE Services On-Premises, especially when manages a large number of groups and users across the entire organization, granting these broad read permissions Group.Read.All, GroupMember.Read.All, and User.Read.All would expose a significant amount of data that is irrelevant for the IDE Services functionality. Reference: Configure API permissions to import of users and groups from Microsoft Entra ID

Question

How can we minimize data exposure while importing and syncing groups from Entra ID to IDE Services On-Premises? Are there alternatives to limit broad data access such as SCIM provisioning, group/role claims in authentication tokens, or on-behalf-of Graph queries?

Answer

1. SCIM Provisioning

SCIM provisioning is not supported for IDE Services On-Premises; it is available only in IDE Services Cloud. However, to reduce data exposure in the on-premises setup, you can:

Hard-code the specific groups that allow having the Group.Read.All, GroupMember.Read.All, and User.Read.All permissions to be imported and synced by using their object IDs in the configuration file. IDE Services will import and sync only the groups specified in the configuration file, rather than the entire tenant, even though the Graph app has tenant-wide read permission. This approach effectively limits which Entra objects are actually connected. Reference: Update your server configuration file.
```
tbe:
  users:
    import:
      enabled: true
      provider: 'entra'
      url: 'https://graph.microsoft.com'
      mapping:
        groups:
          - '<object_id_of_group1>'
          - '<object_id_of_group2>'
      admin-groups: ['<object_id_of_group1>']
```
Use Just-In-Time (JIT) provisioning for user registration. This ensures that only users who authenticate for the first time are created in IDE Services, effectively limiting accounts to active IDE users. As such, IDE Services users will be limited to actual IDE Services consumers only.

In addition, create a dedicated Entra ID app registration, which includes these permissions Group.Read.All, GroupMember.Read.All, and User.Read.All, and with strict admin approval and logging. If using features like Administrative Units or separate tenants, you can scope what the app can access at the directory level. Please note that these scoping controls are managed within your Entra configuration and are not controlled by IDE Services.

2. Group Information via JWT

Supplying group or role claims within the authentication token is not supported for On-Premises setups. OAuth2 is used solely for login purposes, while group synchronization remains a separate Graph-based process.

3. On-Behalf-Of Graph Queries

The /me/memberOf endpoint for retrieving user-specific groups is not supported. On-Premises deployment relies on app permissions for Graph integration with scheduled import operations.

Additional Recommendation

If data-protection policies allow, IDE Services Cloud might be a viable alternative. It integrates with JetBrains Hub by default, offering SCIM 2.0 for push provisioning from Entra ID, and provides more flexibility regarding group mapping and data access scopes. Reference: SCIM Provisioning