Local accounts in Atlassian for break glass procedure

[Mahesh Bhosle]

Hi,

We are currently evaluating/configuring SSO authentication for our Atlassian environment, and had a question regarding contingency access.

In the event that SSO authentication does not work properly, or if there is an issue during the SSO configuration/setup process, does Atlassian support local user accounts that can still authenticate directly to the platform?

Specifically, we would like to understand whether there is a recommended “break glass” procedure that allows administrators to retain emergency access independent of the SSO identity provider.

Could you please clarify:
- Whether local/native Atlassian user accounts are supported alongside SSO
- If local admin accounts can be excluded from SSO enforcement
- Any best practices recommended by Atlassian for emergency or recovery access scenarios

Thank you for your assistance.

Best regards,
Mahesh

[Arkadiusz Wroblewski · Accepted solution]

Hello @Mahesh Bhosle 

Atlassian Cloud doesn't use local product accounts like Data Center did, so if your IdP goes down, global SAML enforcement will lock out your admins.

You need an emergency admin account configured to bypass SSO.

You can achieve this either by using an email address entirely outside your verified domains, or by isolating a corporate domain account inside a dedicated Atlassian Guard authentication policy with SSO disabled. Just make sure this account is strictly reserved for emergencies, protected by native 2FA with securely stored recovery codes, and heavily monitored for any activity.

Best,

Arkadiusz🤠

[Mahesh Bhosle]

Thank you, Arkadiusz.

[Arkadiusz Wroblewski]

@Mahesh Bhosle 

You're welcome. Having a backup administrator is generally a good practice. You never know what might happen.