Atlassian Acces + Azure SSO / Conditional Access with named locations

Question

Hey there,

we recently setup Atlassian Access with our Azure AD to secure our logins.

In the next step we want to use "conditional access" to enforce the use of VPN and specific public IPs. I've setup a rule and the login will be blocked if I connect from a foreign IP address.All fine. But if I disconnect the VPN from a valid session the login at Jira still persists? All other Apps like Google Gsuite noticed very fast, that the conditional requirements are now missing.

So is this behavior intended or just a bug? when will the user be kicked out from the session? The general logout time would be way too long

Regards,

Jonny

Charlie Misonne · Answer

Even though this comment is quite old I think the info is extremely useful.

The Atlassian session will not expire when the Microsoft session expires. I was looking for this information.

Thanks!

Dave Meyer · Answer

@Nicholas Molina your understanding is correct. As mentioned you can mitigate this risk through session duration controls (or using device management software, but this isn't my area of expertise). But IP allowlisting via the Premium plan is the easiest way to comprehensively assure there is no non-VPN access.

Nicholas Molina · Answer

I wanted to follow up on this as we have a similar issue. It seems like we need to continue using an Atlassian Premium subscription to keep the IP Whitelist enforced otherwise the user can authenticate in-network using Azure AD then disconnect from our VPN and the Atlassian session continues even though it fails the Azure Conditional Access IP Whitelist policy.

Any updates?

Thanks,

Nick