Atlassian managed accounts and Azure AD

Simon

Hi,

I have added my domain name to the atlassian admin organization section. I plan to integrate with Azure AD so my users will authenticate with their Azure AD credentials for all things Atlassian based. 

When I verified by domain name a large number of users were pulled in as managed accounts (to my surprise). These users access my customers JIRA or have at some stage signed up for an Atlassian account I assume. 

My question is what will be the experience for these users if I fully integrate with my Azure AD. 

1. Will the managed accounts still login with their existing passwords?
2. Will they be forced to change from using their existing Atlassian credentials to using their Azure AD credentials?
3. These managed accounts appear to incur a cost which puzzles me as they are accessing my customers Jira.

 

Thanks

S

Daniel Eads

Hey Simon,

Welcome to the Community! I'm going to assume that by "fully integrate with Azure AD", you mean also enabling SAML SSO as described in the Azure AD guide for Atlassian Cloud. Let's take a look at your questions:

1. Will the managed accounts still login with their existing passwords?
   The accounts will use their existing Azure AD passwords once you've fully integrated Atlassian Cloud to use SAML from Azure AD. Users will no longer use their Atlassian passwords to sign in to your Atlassian services.
2. Will they be forced to change from using their existing Atlassian credentials to using their Azure AD credentials?
   If you enable SAML SSO with Azure AD, your users will see an Azure AD sign-in screen on Atlassian Cloud products if they aren't already signed in to Azure AD. If they do already have an active Azure AD session (by being logged in to Office365 for example), they will not be prompted with any login screen at all.
   
   
3. These managed accounts appear to incur a cost which puzzles me as they are accessing my customers Jira.
   Account managed via Atlassian Access (our identity management solution) are by subscription. You're required to have domain verification to manage any accounts, so presumably this should only pick up accounts you control already (example: email@yourdomain.com). If customers from another company have accounts on your Jira, you shouldn't be able to subscribe those accounts to Atlassian Access unless you also control the domain they are coming from (othercompany.com). If you could explain a little more about what accounts you're not expecting to manage and if they are part of your domain or not, that would help clear up the situation.

It's also possible to not add SAML SSO to an Access policy, which would have users continue on with their existing Atlassian passwords separate from your Azure AD setup. You would apply any password policy you wanted to through Atlassian Access then (per our instructions here) and Access would also manage any MFA policies for those Atlassian accounts. The downside of this is that you wouldn't have Single-Sign-On with the other applications you already have set up with Azure AD, and your users would have to manage two different sets of credentials. With SAML SSO enabled, Atlassian Access would hand off password management and MFA to Azure as described here.

Hope that clears things up,
Daniel | Atlassian Support