nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

User management and SSO - Atlassian Access

serge calderara

Dear all,

We have actually a Jira Data Center version 9.11.3 hosted in Azure AD.
We have our company Active Directory in Azure AD as well

We are working with external vendor and subcontractor for which which give them access to our central Jira .
We are handling user account in the following way:

When a subcontractor request an access to our company Jira instance, we send that user an invitation from azure using his own company email
That user account became a GUEST account in our company AD, but the account itself is still manage by each subcontractor Active Directories
The we implement an Active Directory sync of our company AD which then sync as well external agencies account with their respective account
We implement SSO for authnetication to our Jira Datacenter

Based on this context our company DO NOT and DO NOT WANT to manage subcontracors accounts in our AD

We are now studding the possible migration to Jira cloud from our Data Center instance by keeping the user management context describe above.

We have see that the first thing to do is do use Access in order to Verify our domain name.

Q1 : So I guess that we will have to verify each of our subcontract domain as well, right ?

Then we have notice also that when we verify a domain we need to claim return account . I understood that the list of users return after domain verification are user which have an Atlassian account. But by claiming user accounts, users will be manage in our company jira instance. THIS IS WHAT WE DO NOT WANT

Q2 : If we do not claim any accounts, and if we go to same account creation request process describe in step 1 to 4, does users will still be able to use the instance if not claimed or does new user will be automatically created as an Atlassian account ?

I hope you understand our goal and the key point which is that we do not want to manage external subcontractors users account in our futur jira cloud instance

Is this possible ? and if yes what are the exact steps to reach our goal

If it is not possible, what could be a workaround ?

Thnaks for sharing

Accepted answers

Ste Wright

Hi @serge calderara

Atlassian Access only allows one Organization to have claim to a domain - so it's unlikely you'll be able to claim each vendor's domain, nor want to.

You have two options here...

Give each vendor access via your AD / identity platform (eg. provide them an email address with your domain)
Allow them access as an external user - utilising their own Atlassian account, which could be managed from their own Atlassian Access.

You could setup external user security for the vendor's users? This sends them a verification code when they login - and you can set the regularity these codes are required.

Ste

All comments

David Friedrich

Hi @serge calderara ,

not a direct answer to your questions, but some insights on how Atlassian Access works, as I think you're mixing it up with some general admin hub functionality.

Atlassian Access enables single sign-on, user sync, and provisioning. It gives your org admins visibility and security across all the accounts, products, and sites within your Atlassian Cloud organization.

Before you can subscribe to Atlassian Access, you need to verify a domain and claim its accounts.

If you are able to verify domains of your subcontractors as your own depends on them. A DNS entry is needed to verify.

You can connect one identity provider when you subscribe to Atlassian Access, and connect to multiple ones when you subscribe to an Enterprise plan. User provisioning integrates an external user directory with your Atlassian organization. This integration allows you to automatically update the users and groups in your Atlassian organization when you make updates in your identity provider.

SAML single sign-on (SSO) allows your users to authenticate to Atlassian cloud products through your company's existing identity provider so they can access multiple tools with the same set of credentials.

An authentication policy allows you to specify authentication settings for different sets of users and configurations in your organization. This includes two-step verification and password requirements, for example.

On top, Access gives you the following features:

shadow IT: you can see sites and products that users with managed accounts created outside your Atlassian organization.

API Tokens: Users can create API tokens to perform authenticated operations with product APIs. With an Atlassian Access subscription, an org admin can revoke these tokens.

Atlassian Access audit log: tracks key activities that occur within the Cloud organization: changes to User accounts and Groups, Products, Security policies, and the organization as a whole.

Hope this helps a little.

Ste Wright

Hi @serge calderara

Atlassian Access only allows one Organization to have claim to a domain - so it's unlikely you'll be able to claim each vendor's domain, nor want to.

You have two options here...

Give each vendor access via your AD / identity platform (eg. provide them an email address with your domain)
Allow them access as an external user - utilising their own Atlassian account, which could be managed from their own Atlassian Access.

You could setup external user security for the vendor's users? This sends them a verification code when they login - and you can set the regularity these codes are required.

Ste

serge calderara

@David Friedrich thanks for your reply but it is not make my mind clear based on the scenario I have describe

To explain again, our Jira is connected to our Single and unique Identity provider which is our Azure Active directory.

All our external subcontrators accounts are part of our AD but as GUEST accounts, which means their own account are manage by their respective company active Directory.

We do not want to manage external subcontractor accounts in our potential Jira cloud.

So the main point is as below :

Q1 : DO I have to verify Each domain of external subcontractor even if we do not want to claim their account ?

Q2 : Let say we validate each external agency subcontractor domain in addition to ours, but we do not claim any account from external users. What will happen when our unique Identidy Provider Azure AD will send users account to Jira cloud, does those external users will be still valid and enbale even if they did not get claimed ?

IMPORTANT :
We MUST use only our unique Azure ID where external GUEST account will belong to on demand

Thanks for your comment on

regards

serge calderara

@Ste Wright thnaks for your reply

Based on your comment and if you are 100% sure that we cannot claim multiple domain.

Your option 1 is absolutely not possible in our company as we work with more than 500 external subcontractor account around the world and our security policy is strict on this

Your option 2 :
Please note that our subcontractors account do not have any Atlassian account as they do not use it for their own purpose and so do not have as well any own Atlassian Access

The way Access has been think of by Atlassian is weird and consider you simply work only for one instance of yours. But in todays world we work with many people around the world for which we simply want them access to our centralize tool

What else ? does anything else can be done ?

regards

Ste Wright

Hi @serge calderara

You can claim multiple domains - but as I say, only one Org can claim each domain. That isn't to say you can't have multiple instances under that Org (eg. multiple separate Jira instances).

If the vendors do not have their own Atlassian Access Org, you could...

Claim and manage their domain, and...
Setup authentication policies to ensure you're only managing and paying for the relevant users

This might be an option you could consider?

It will claim every user though under each email domain, regardless if they are working on your instance or otherwise.

Ste

serge calderara

@Ste Wright , thnaks for your reply.

Our single company will handle a single our ORg with only one a single Jira instance which is our own

We can add their domain for verification in our ORG after asking them to place the respective TXT records

You said :
"It will claim every user though under each email domain, regardless if they are working on your instance or otherwise."

This is exactly what we are not allowed to do because we do not want to manage their account in our ORG

What is not clear in what I try to explain ?

unknown

@serge calderara Hi Serge,

Were you able to find answers to those question ? specially the last Q2 ?

We are in same situation as you, and we are not able to make Guest accounts working using SSO, even if we claim the accounts on Jira.

Were you able to connect your guest users using SSO using verified domains ?

Thanks for your answer

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

server

jira

jira-software

jira-software-server

atlassian-guard

migration-customer-care