How can I setup SSO between Azure AD and JIRA?

Question

Hello,

We're looking to setup Single Sign-On with our JIRA users and Azure AD. We have around 300 users. Most of these users have Azure AD accounts already. We were thinking of using guest accounts in Azure AD for our external users. Looking at the documentation below, I have a few questions:

https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/jiramicrosoft-tutorial

1. Given we don't have any on premise JIRA infrastructure and our users are already in Azure AD, do we need to download and install the Microsoft JIRA plugin?

2. Would this work OK with our external users that have Azure AD guest accounts? I'm specifically thinking if the guest account is already a SSO member in another JIRA tenant.

3. How long is the down time for setup?

4. Can the setup be quickly and easily reverted? We don't have a test/dev environment to try this.

Thanks in advance

TechGuy2020 · Answer

Hi,

Apologies for the late reply on this, but I've finally got around to trying this in a test lab, but am hitting 2 issues:

1. Verification of the domain name - in the atlassian admin portal there's no option to verify the domain name (https://admin.atlassian.com/). I just don't have the directory domains option available (https://confluence.atlassian.com/cloud/domain-verification-873871234.html) and nothing looks like the right option.

2. In Azure, my domain name is "contoso-testa.onmicrosoft.com" and in JIRA the domain name is "contoso-testa.com". Do the users and domain names need to match, i.e. both domain names and user accounts need to "contoso-testa.com"?

Thanks

TechGuy2020 · Answer

Thanks Jimmy, I'll give the URL a good read through and look into setting up a test environment.

Jimmy Seddon · Answer

Hi @TechGuy2020,

Welcome to the Community!

I can answer a few of these based on our own experiences setting up Jira Cloud with Atlassian Access.

For starters you should actually check out the documentation for connecting with Cloud since the documentation you listed is for Jira Server... check this out it might make more sense:
https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/atlassian-cloud-tutorial

1. Based on the fact that you were referencing the wrong documentation probably not.  But you will need to install and Atlassian Cloud extension on you Azure AD instance.

2. We didn't make any guest accounts so I'm not 100% sure but I believe this should work as long as they are included in the group(s) that are being sync'd to Atlassian Access.

3. This one unfortunately I don;t have a good answer to.  We setup a test organization before trying this on our production organization and they both took different amounts of time to complete (I'd recommend doing this when you can be offline for an extended period like a weekend).

4. Yes you can delete the SAML configuration from the same screen that you set it up in the first place which will turn it off and users will authenticate the way they normally do.

I hope that helps!

-Jimmy