Hi,
I'm a bit puzzled. I followed this guide https://confluence.atlassian.com/cloudkb/configure-saml-single-sign-on-for-portal-only-customers-with-entra-id-formerly-known-as-azure-ad-1541081409.html to set up SSO for portal-only customers but it always redirects to https://login.live.com/oauth20_authorize.srf and not to our actual Entra ID login page.
I went over the guide many times to make sure I did not omit something or made a mistake. The request is actually reaching https://login.microsoftonline.com/{{uuid}}/saml2, the entreprise app. login URL, but is redirected to login.live.com from there so the issue is definitively in Entra ID.
Did anybody stumble upon this issue and resolved it?
Hi @Julien Béchade
This happens because of Home Realm Discovery (HRD) in Microsoft Entra ID. When a user enters an email address that Entra doesn’t recognize as part of your managed domains (for example, @gmail.com or @outlook.com), Entra assumes it’s a Microsoft Account (MSA) and sends the user to the consumer login service at login.live.com.
The Atlassian guide you followed sets up SAML SSO using an Enterprise App in your workforce tenant. That works perfectly for your employees or guests in your tenant, but it cannot authenticate random external users unless they exist in your tenant or you use a customer identity solution.
Option 1: B2B (Guest users in your tenant)
Option 2: External ID / B2C
For true external customers, you need B2B or B2C.
Microsoft Entra B2B best practices and recommendations - Microsoft Entra External ID | Microsoft Learn
What is Azure Active Directory B2C? | Microsoft Learn
Hope this helps 😊
You could look at this previous community post
https://community.atlassian.com/forums/Jira-Service-Management/Portal-only-customer-SSO-with-Azure-B2C/qaq-p/2738020
Hi Christos,
Thank you for taking the time to answer! This definitively helps 🙏
It does make sense that an entreprise app. is scoped to the managed domain.But we happen to have a B2C tenant so option 2 it is.However, I'm not sure how to "configure Atlassian to trust your B2C policy endpoints" to match Atlassian requirements. Any pointers?
Ok so it looks like I would first need to create a SAML app. in B2C following this guide https://learn.microsoft.com/en-us/azure/active-directory-b2c/saml-service-provider?tabs=windows&pivots=b2c-custom-policy. Am I on the right track?
This is gold, thank you @Marc -Devoteam-
That article https://www.camiloterevinto.com/post/azure-b2c-atlassian-sso listed on the post you linked to was very informative and straight to the point.
Please accept my answer as a solution, if my answer helped to solve or provide a workaround to your request.
This will help other community member trying to solve the same or provide them with a work around
P.S. If the answer is very valuable to you, please share some kudos.
It looks like you're new here. Sign in or register to get started.
