Atlassian Guard - two 'default' policies - how to make one not default

Question

Hi

We recently started using Atlassian Guard and have set up SSO with our identity provider. There was an original default authentication policy containing all users (active and inactive). I created the new SSO policy and added all the active users to it (except one break-glass admin account) and made it default. But now there are two authentication policies both marked as default:

* the original 'Applies to all users' containing inactive users and the break-glass account
* the SSO-enforced policy containing all active users

I was expecting that when I invite a new user they would fall into the 'default' SSO-enforced policy but that didn't happen. I needed to manually move them from the original 'default' policy to the SSO-enforced 'default' policy which means an extra step every time a new user is invited - this can't be right!

How can I solve this? The documentation doesn't cover this scenario https://support.atlassian.com/security-and-access-policies/docs/what-is-a-default-authentication-policy/

I tried deactivating the account of an inactive user but this had no effect in the authentication policies.

I am thinking that the only solution would be to create a new 'non-SSO' policy for the break-glass account and then move all the inactive users into the SSO-enforced policy. Would this work? When there are no members in the original 'Applies to all users' policy, will I be able to make it non-default?

If this method should work, is there any way of doing it other than manually one user at a time? I have searched and do not see any API for changing users' authentication policies.

Thanks,

Julia

Rantly Liriano · Answer

Thank you for providing this answered.  So how you manage that new users go directly to the IDP policy instead of the local policy?

When we invite new users manually, they go automatically to the local policy and I have to change them to the IDP policy to enforce SSO manually?  I am trying to avoid this step.

Julia Foden · Answer

Hi @Rantly Liriano

I did get it solved eventually. I opened a ticket with Atlassian and there was some contradictory advice given and we had to have a call in the end but it is sorted now.

So - my requirement is that we want all of our internal users to be 'managed accounts' with SSO enforced, except for one break-glass admin account. We want to invite new users manually ie not just-in-time provisioning and not using Guard for user provisioning.

What we have setup now is

* our domain is verified and the Claim Setting is set to Automatic
* the Identity Provider is linked to our domain

I think these are the only changes I made. This works for us now.

We do still have two authentication policies marked as Default. One is for users in our identity provider directory and the other is for 'all users'.

I hope this works for you. If not go to Atlassian Support; if you select Guard they seem to go to a good helpful human rather than the awful bots we get on some request types!

Rantly Liriano · Answer

is there is any solution for this?  This exactly what is happening to us.