Jira Sign-In Account Options For External Users?

Question

We currently use Active Directory accounts for all our internal employees and it works fine.

For external users, we have to create new active directory accounts and buy Microsoft AD CALs and manage these external user's account password resets.

The external users belong to too many external domains for us to set up LDAP for all those domains, so we want another option that doesn't require us to manage passwords for external users.

What other options are available that will allow the external users manage passwords on their own?

For instance, can we set up Jira access for Azure AD Guest users?

Any other options that are secure, yet convenient to the users and less management for us?

Brant Schroeder · Answer

The Jira internal directory will allow for all of your requirements as will using LDAP to connect to Azure AD.

Jax · Answer

We don't want to try to connect to 100 different external LDAP directories for all these users.  All those domain's IT departments are not going to agree to participate in allowing access to their LDAP servers anyway.

That's why we need a solution that doesn't require the other domains to open up any access to their network, but we don't want users to need to contact us for password resets.

The most we would want to do is grant Azure AD Guest accounts where the user's manage and reset their own passwords or else some other solution where we don't need to create any accounts for them at all and they use their own existing external accounts and passwords from their own employers.

Brant Schroeder · Answer

Jira allows you to use multiple user directories and have a priority based on their order.  We use LDAP for our internal user and Jira's internal directory for external users. This has worked well for us because we can help troubleshoot accounts if necessary but the user has the option to manage their account and profile through Jira's built in interface.  You could use a different directory external to Jira that supports LDAP or look at implementing something like Crowd.