Atlassian Guard - two 'default' policies - how to make one not default

[Julia Foden]

Hi

We recently started using Atlassian Guard and have set up SSO with our identity provider. There was an original default authentication policy containing all users (active and inactive). I created the new SSO policy and added all the active users to it (except one break-glass admin account) and made it default. But now there are two authentication policies both marked as default:

• the original 'Applies to all users' containing inactive users and the break-glass account
• the SSO-enforced policy containing all active users

I was expecting that when I invite a new user they would fall into the 'default' SSO-enforced policy but that didn't happen. I needed to manually move them from the original 'default' policy to the SSO-enforced 'default' policy which means an extra step every time a new user is invited - this can't be right! 

How can I solve this? The documentation doesn't cover this scenario https://support.atlassian.com/security-and-access-policies/docs/what-is-a-default-authentication-policy/

I tried deactivating the account of an inactive user but this had no effect in the authentication policies.

I am thinking that the only solution would be to create a new 'non-SSO' policy for the break-glass account and then move all the inactive users into the SSO-enforced policy. Would this work? When there are no members in the original 'Applies to all users' policy, will I be able to make it non-default? 

If this method should work, is there any way of doing it other than manually one user at a time? I have searched and do not see any API for changing users' authentication policies.

Thanks,

Julia

[Tudor Tofan]

Hi @Julia Foden 

I have checked on 2 of my customers' Jira instances, and indeed, there are 2 policies marked as default in both of them.

Now, I haven't been able to find specific documentation, but my suspicion is the following: In my situation the policy on the left is the one which is default for all local accounts. So if you manually invite an account, they would go into this policy.
Then, on the right, I have whatever default policy I have for my managed users. So basically, if I invite a managed user (maybe via user provisioning), it goes into the one on the left.

I don't think it's a bug, but it's more of a lack of documentation.

By the way, do you have managed users and user provisioning?

[Julia Foden]

Hi @Tudor Tofan 

Interesting that I am not alone in having 2 policies marked as default!

All of the accounts in our domain are classified as Managed Accounts including the inactive/deactivated accounts. We do not have user provisioning set up. I manually invite new users or reactivate existing accounts. When I invite a new internal user from our domain they become a managed account but they fall into the original policy (non-SSO).