Allow all users from a certain domain with SSO

Question

I am relatively new to Jira servicemanagement en still evaluating if it fits our use. I managed to find most things, but the following is still a problem.

I don't want a public site for customers. I want to use Jira for our employees. I have set up SSO with AzureAD.

I have an existing account as an agent and I can log in to the https://[url].atlassian.net/servicedesk/customer/portals with my company email and Single Sign On. When I enter my email, a button appears 'Your group uses SSO', pressing this buttons forwards me to login.microsoftonline.com and I can log in fine.

What I would like is this to work with every @mydomain.tld account. However, when I enter an email from someone who is not a Jira user, I am not forwarded to the SSO login page, but a password box appears.

I was expecting to be able to do whatever@mydomain.tld, but that is nog how it works?

Ananjan_miniOrange · Answer

Hi @Peter de Boer

I am ananjan from miniOrange.

We have a solution, SSO Integration with Helpdesks, which can possibly cater to your requirements.

Just check it out once and feel free to let us know if this works for you!

You can raise a ticket here or contact me directly at @ananjan.mishra@xecurify.com for more information.

Best Regards,

Ananjan Mishra

Ed Letifov _TechTime - New Zealand_ · Answer

Hello, @Peter de Boer

Your account, being a Jira user (and as such a user with site access), is an Atlassian Account. SSO is only available to Atlassian Accounts.

Portal-only users have their credentials stored in JSM itself, hence the request for the password, as in "what's your password in *this* JSM instance". This is indeed designed to server public support scenario.

So, for the existing Portal users a site admin needs to migrate them to Atlassian Account in Admin/<site>/User Management/Jira Service Management/Portal customers – there is an action "Migrate to Atlassian account" next to each record. This will give the user site access, but not access to any products. Unfortunately this is a manual operation.

Since you have Azure AD in the backend – you should really configure User Provisioning, and push these portal-only users to Cloud automatically without product access. However without giving product access, I believe this won't give the site access either without manual actions by a site admin.