Atlassian Access Licensing for JSM customers

[George Matrozos]

Hi, in this article, there is a description on how to provision internal customers of a JSM service desk. https://confluence.atlassian.com/cloudkb/configure-atlassian-access-saml-single-sign-on-and-user-provisioning-for-customer-accounts-in-jira-service-management-1038778740.html

My question is that we have a JSM with 10 agents and 10 Atlassian access licenses for SSO and user provisioning (Azure AD). Customers belong to the same verified domain. Is there a need for licensing those customers with Atlassian Access? Will these customers have SSO if I dont license them with Access?

[Walter Buggenhout _ACA IT_ · Accepted solution]

Hi @George Matrozos,

Atlassian Access and licensing to your Atlassian products are actually different things. Atlassian Access takes care of user provisioning from your user directory so you only have to define them once.

Granting them a license is done by adding users to groups. And those groups are associated with product access of your different products (Jira Software, Jira Service Management, Confluence, ...). While Atlassian has default groups for each product, you can perfectly add groups from your Azure AD to product access, so adding users to those groups automatically grants them the required license.

Customer access in JSM is something special as this type of users does not require a license. You can grant customers access to a JSM project by adding their group directly to the Service Desk Customers role in your project. In that way, you grant them access to your project while they don't consume a license.

With Atlassian Access enabled, SSO access for service desk customers should be possible as explained in the workaround on JSDCLOUD-630.

Hope this helps!  

[George Matrozos]

Thank you @Walter Buggenhout _ACA IT_ . I get JSDCLOUD-630. So if I have 100 internal customers and 20 agents (all in the same verified domain) I will need 120 Access Licenses (to provision them though Azure AD and have SSO). This is broken down to  100 in a group called Customers and 20 in a group about agents (with the appropriate jsm users group) (100-200) Atlassian Access licenses and 20 (16-25) JSM licenses? 

[Walter Buggenhout _ACA IT_]

Technically that is correct. But your JSM customers won't be billed in Atlassian Access (unless of course they are licensed users of another Atlassian product) - see the licensing faq 

[George Matrozos]

Thank you @Walter Buggenhout _ACA IT_ I think that they will not need Atlassian Access license since they will only be internal IT SD customers

Thanx again!

G

[Stéphane Veraart]

@Walter Buggenhout _ACA IT_ : Thanks for your answers here and interaction with George about this subject.

We are now dealing with a similar situation with JSM Cloud, with 50 agents and about 1600 (internal) customers. All of them exist in the same Azure AD and we are looking at giving them access to either the application (agents) and the portal (customers).

Paying for 1600 customers (internal) using Atlassian Access would be to cost ineffective for the client, because they'd pay more for Access than actual JSM (which to me doesn't even feel right, but that's another story).

For the licensing FAQ link you referred to in your previous reply you are referring to the non-billable policy, right? If I understand this correctly we could have the 'customer' users use the non-billable policy. They wouldn't have SSO then however, which could be a challenge.

JSDCLOUD-630 unfortunately is not yet implemented so we have to wait for that for a bit.

Alternatively we could use Azure AD to manage everything and use that as access management SSO 'solution' - however I am not sure if this works for customers as well.

So I am not sure what it the best solution to choose here.

Do you have any experience with this?

[ananjan_miniOrange]

Hi  @George Matrozos, @Stéphane Veraart, @JiraYo,   

I am ananjan from miniOrange.

I am delighted to let you know that we have got a solution, SSO Integration with Helpdesks which can possibly cater to all your requirements.

Just check it out once and feel free to let us know!

For more information, you can raise a ticket here or contact us directly at atlassiansupport@xecurify.com. 

[JiraYo]

I have the same question. Did you ever get a formal answer? do i need to license my customers in order to use single sign on with jira service desk? They reply is ambiguous and confusing. Can someone from atlassian comment directly about this?

If i have 800 customers, and i want to use single sign on with JSD, do i need 800 licenses or no?

[George Matrozos]

Dear @JiraYo no I did not get a direct answer but I know now that my delivery team has implemented such cases in clients. I do not know the exact technical mix of how they do it but I assume a non billable policy group