Non-billable authentication policy when access to Jira/Confluence is managed by external IdP?

Jason M__f93pjv

Strangely Atlassian is freezing support requests as soon as I open them, so will try to ask here:

I understand the concept of a non-billable authentication policy. What I don't understand is how that works when the users for our site are managed by an external IdP & we enforce SSO.  In order for an account to access Jira, it must be part of the jira-users group. jira-users group is sync'd & managed by our IdP.

But according to Atlassian's documentation: You can't add the users you sync from your identity provider (e.g., Okta, Azure AD, Google Workspace) to a non-billable policy.

So in this case, how can I add an existing account to a non-billable policy if it's managed by our IdP? Or create a new account to be part of the non-billable policy if it requires an email invite link to be valid and also needs to be part of the jira-users group anyways to access?

Thank you,
Jason

Alex Koxaras -Relational-

Hi @Jason M_ 

I faced a similar case with two of my clients. Atlassian will bill you for all users that you want to enforce SSO. First thing first:

Or create a new account to be part of the non-billable policy if it requires an email invite link to be valid and also needs to be part of the jira-users group anyways to access?

As an administrator (site/org) you can invite any user you want. That user will not be managed by your identity provider (e.g. he/she is not part of your company but you want to grant access to that user). That user will be stored in Jira Directory and not the AD. That part is solved.

To grant product access to a user, you either make him a member of the group that grants product access (in your case is jira-users) OR you add another group to grant product access. That most likely you can do (create a group e.g. external-jira-users, place the new user in that group and add this group to product access (go to cog > products > product access > manage access > add groups).

Now for the following question:

What I don't understand is how that works when the users for our site are managed by an external IdP & we enforce SSO.  In order for an account to access Jira, it must be part of the jira-users group. jira-users group is sync'd & managed by our IdP.

But according to Atlassian's documentation: You can't add the users you sync from your identity provider (e.g., Okta, Azure AD, Google Workspace) to a non-billable policy.

So in this case, how can I add an existing account to a non-billable policy if it's managed by our IdP?

Long story short is this: If you want your synced users to have SSO, then you can't add them to a non-billable policy. The user is billable IFF:

1. The user is synced
2. The user has product access to any tier (this includes Trello users)
3. The user doesn't belong to an enterprise plan
4. Account is active

For the (2) there is an open issue https://jira.atlassian.com/browse/CLOUD-11072 which I watch. Last update was rather disappointing for us all...

Hope all the above helps!