TL;DR: You can now encrypt SAML assertions for Microsoft Entra ID in Atlassian Cloud. This adds a layer of confidentiality to your identity data during the SSO process by ensuring sensitive attributes aren't exposed in plaintext.
Hi everyone,
I’m David Dooley from the Identity team, and I’m excited to share a security update that many of our enterprise customers have been asking for: SAML encrypted assertions for Microsoft Entra.
Why this matters for your security posture
When your team logs in via SSO, the SAML assertions exchanged can contain confidential info—like user identifiers and email addresses. By encrypting these assertions using Atlassian’s public certificate, it will support requirements for data in transit confidentiality.
This is a key step for organizations with compliance requirements or those simply looking to harden their identity infrastructure.
What’s now available?
We’ve designed this to be as seamless as possible within your existing workflow:
- Direct Integration: You can download Atlassian’s public certificate directly from your security settings and drop it into your Microsoft Entra token encryption settings.
- Granular Control: You can manage encryption independently from other SAML features (like single logout).
- Lifecycle Management: We’ve added clear controls and warnings to help you manage certificate updates without accidentally locking users out.
How to get started
- Navigate to your Microsoft Entra SAML configuration in Atlassian Administration.
- Enable SAML assertion encryption and download the public certificate.
- In Microsoft Entra ID, upload that certificate to your Atlassian enterprise application’s token encryption settings.
- Confirm the configuration back in Atlassian Administration.
For a step-by-step walkthrough, check out our Configure SAML Encrypted Assertions for Microsoft Entra | Atlassian Support.
What’s next?
While we are starting with Microsoft Entra, we are working to expand this to other Identity Providers (like Okta) in the future.
We’d love to hear from you: How are you currently managing identity security for your Atlassian tools? If you have questions about the setup or want to share how this fits into your security strategy, let’s chat in the comments below!
Cheers,
David Dooley
Senior Technical Program Manager, Identity
