Jira - Jira Service Management - SSO

[ML]

Hello,

I am currently in my second year of apprenticeship in an IT department, and I am contacting you regarding a project to implement Jira Service Management for IT department support.

We would like to set up single sign-on (SSO) for access to Jira - Jira Service Management (customer-side Service Center) for our 90 users, integrated with our identity provider (IdP).

The idea is to avoid our users having to create an additional account to log in, which is why we want to link Jira Service Management to our identity provider (Azure AD) so that their username and password are the same as those they use on a daily basis.

My question is the following:

To implement SSO, do we need an Atlassian Guard licence for each user (i.e. 90) or is a single licence for the administrator enough when setting up SSO ?

Thank you in advance for your help and advice.

Best Regards,

[Damien Versluis]

That link gives the big picture details.

However you do not need a licence for Guard if you are only a customer.  (ie you are defined as a Customer role).

If you are a JSM agent or JSM agent & customer then you will need a Guard licence. 

[Marc -Devoteam-]

Hi @ML 

If you only want SSO for JSM customers, check this KB; https://support.atlassian.com/atlassian-cloud/kb/user-provisioning-and-saml-single-sign-on-for-jira-service-management-customers/ 

If you also want your agents (Jira users) to use SSO, then you need Atlassian Guard.

The Guard license is per user.

See https://www.atlassian.com/software/guard/pricing 

[ML]

Hi @Marc -Devoteam- 

Employees would only access a pre-created JSM portal to create and view their IT support requests. Does this mean that employees should be categorised as customers ?

Ideally, they would log in using their Microsoft credentials, which they use on a daily basis. We therefore want to connect EntraID with Jira Service Management to apply SSO, which requires at least one Atlassian Guard licence.

I would like to know if we need an Atlassian Guard licence for each employee accessing the IT support portal or less (only for agents).

Thank you.

[Marc -Devoteam-]

Hi @ML 

Yes, you need Atlassian Guard for this.

See https://support.atlassian.com/security-and-access-policies/docs/configure-saml-single-sign-on-for-portal-only-customers/ 

[ML]

I understand we need Atlassian Guard for SSO.

My question is more about : Do we need only one Atlassian Guard licence to configure SSO or do we need one for each employees (called customers in Atlassian environment) ?

Thank you.

[Marc -Devoteam-]

Hi @ML 

If they are licensed user in your company and you have linked your domain, yes they will be billed based on the number of active users.

If they are external users (not in your domain), then you could link with the customer IDP  to have customers login with SSO, at no cost.

Also be aware, when you have claimed you domain and use Atlassian Guard, all members using Trello or setup their own Cloud instance will be seen as billable users.

[ML]

Hi @Marc -Devoteam- 

Who do you consider as ‘users’ ? Agents, customers, others ?
We thought we would only assign licences to agents, the IT employees who will respond to IT support requests.

Once we link Jira to our domain, will Atlassian charge us for a licence for all users, regardless of their role ?

[Marc -Devoteam-]

Hi @ML 

If you claim a domain and you want your users to use SSO on JSM itself and on the portal, all these will count towards the Atlassian Guard bill.

And users that use an email address from your company domain and use Atlassian products outside your instance, like Trello, will also be billed.

To get more clarity, raise an issue via Atlassian Support and choose the Billing,Payments and Pricing option.