Inquiry about SAML integration between Entra ID (Azure) and Jira

Question

I hope you're doing well.

I’m trying to synchronize my identity provider with Jira, and I’m not sure if there’s an alternative that doesn’t require an Atlassian Access subscription. From what I understand, it seems necessary to have an “intermediary” to manage the authentication process between login and information retrieval, but I don’t think paying for it should be the only option.

Could you confirm if it’s possible to configure a SAML connection between Entra ID (Azure) and Jira Admin without needing to purchase Atlassian Access?

Lucas Knorr · Answer

When it comes to user provisioning:

You could build your own user provisioning process (which has nothing to do with authentication) with the official REST API by Atlassian: https://developer.atlassian.com/cloud/admin/user-provisioning/rest/intro/#about.

Or you could use a plugin like https://marketplace.atlassian.com/apps/1222000/scim-provisioning-user-sync-group-sync-for-jira?hosting=cloud&tab=overview which takes care of the provisioning.

You do not necessarily need SAML just for provisioning. SAML is only required if you want to enforce SSO for your users.

With validating your domain you only prepare the claiming process of your users. After you verified your domain you should be able to see a number of Atlassian accounts coming from this domain. Since you are the owner of this domain you will be able to claim these account and turn them into managed accounts of your organization. But this does not mean they have been synchronized to your Atlassian site yet.

Perhaps you can explain in more detail what you have already done and what your current setup looks like.

Gustavo Ezequiel Szemruck · Answer

Hi, @Lucas Knorr.

What I’m trying to achieve is a user synchronization between Azure AD and Jira. The problem is that SAML configuration seems to be mandatory to establish a secure connection. I’ve been researching, but I haven’t found many alternatives to accomplish this synchronization.

On another note, I have a question regarding the User Provisioning you mentioned when I validated my domain. I don’t understand how, by validating the domain via HTTP, 32 users were automatically synchronized, but I’m not sure which path they were pulled from.

If you could provide me with technical information about how this process works, it would be very helpful to bypass the direct synchronization between Entra ID and Jira. This would be possible if I manage to move all the users from my domain to the path the system is currently using, as I wouldn’t need to directly synchronize Entra ID with Jira.

Lucas Knorr · Answer

@Gustavo Ezequiel Szemruck

it depends on what you are trying to achieve. User provisioning (syncing groups and users to Atlassian Cloud) can be achieved without any Atlassian Guard (formerly Access) subscription. As soon as you need your users to be able to authenticate via SSO you require the Atlassian Guard subscription. There is no other option and no workaround. Atlassian has created a monopoly here.