nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

SSO Login Failure After AD Object Migration – Error Code fee08ce7-9206-47c3-b480-e7c2ec684889

Jack Reynolds_h5n5ow

I’m experiencing an issue with logging into Atlassian Cloud products (Jira, Opsgenie, etc.) via SSO after my Active Directory user object was moved to a new domain and then back to the original one. Since the move, I’ve been unable to log in using SSO and receive the following error code:

When we changed my domain, we did this by updating the UPN attribute in Active Directory.

Error Code: fee08ce7-9206-47c3-b480-e7c2ec684889

Error URL: https://id.atlassian.com/error?error=access_denied&error_description=authentication-policy-strategy-mismatch&state=eyJjc3JmVG9rZW4iOiJhZGRiZWNhMS1mYmJjLTQ0MmMtOTJkMS1kMzJkZDc2OGUyNjAiLCJhbm9ueW1vdXNJZCI6ImZlZTA4Y2U3LTkyMDYtNDdjMy1iNDgwLWU3YzJlYzY4NDg4OSIsImNvbnRpbnVlVXJsIjoiaHR0cHM6Ly9heGVncm91cC5hcHAub3BzZ2VuaWUuY29tL2F1dGgvc2Vzc2lvbi1jaGVjay91cy13ZXN0LTIiLCJxdWVyeSI6Ij9jb25uZWN0aW9uPXNhbWwtZjgwZGYyMzAtZjYzZC00YjlkLTgzZjMtYTkwODU3YjYwOTgyJmFwcGxpY2F0aW9uPW9wc2dlbmllJmVtYWlsPWphY2sucmV5bm9sZHMlNDBheGVncm91cC5jb20mY29udGludWU9aHR0cHMlM0ElMkYlMkZheGVncm91cC5hcHAub3BzZ2VuaWUuY29tJTJGYXV0aCUyRnNlc3Npb24tY2hlY2slMkZ1cy13ZXN0LTIifQ%3D%3D

Despite the login failure, I am still receiving email alerts from Opsgenie, which suggests that my email address is still recognised by the system. However, I cannot access the full alerts or interact with the platform.

We suspect that although the AD object appears unchanged, Microsoft Entra ID may have assigned a new immutable ID or object ID during the domain migration, which could be causing a mismatch in identity mapping with Atlassian Access.

Details:

My email address:

Original domain:

Original URL:

Temporary domain:

Identity provider: Microsoft Entra ID

Could you please assist in:

Verifying if my identity mapping is broken due to a new object ID.
Re-linking my current Entra ID identity to my existing Atlassian account.
Ensuring that SCIM provisioning does not create a duplicate user.

*I have submitted this query on the community forums as I'm unable to create a query with my Atlassian account.

Accepted answers

All comments

Valerie Knapp_gp7rpj

Hi @Jack Reynolds , thanks for your post.

I have flagged this to Atlassian so that someone from their service desk can help you with this. I am going to edit your post to remove the identifying details but an agent will talk to you about the specifics in a ticket / support case they can open on your behalf.