You're on your way to the next level! Join the Kudos program to earn points and save your progress.
Level 1: Seed
25 / 150 points
1 badge earned
Challenges come and go, but your rewards stay with you. Do more to earn more!
What goes around comes around! Share the love by gifting kudos to your peers.
Keep earning points to reach the top of the leaderboard. It resets every quarter so you always have a chance!
Join now to unlock these features and more
i've an azure ad tenant withe the following user layout:
User principle Name = ShortName@internal-domain.de
E-Mail Adress = Surname.Lastname@external-domain.de
So our logon name at M365 is always the upnname (ShortName@internal-domain.de).
We've setup the SSO Connection, authentication works within Atlassion. When entering ShortName@interna-domain.de as username we'll be redirected to M365 login. But the user mapping is not correct.
Within Atlassion the User will be created with the upnname and the same value will be the e-mail address value. But I expect the real E-Mail Address to be that value which is the user.mail Attribute within Azure.
I think the problem is, that atlassian only handles the e-mail adress as uniqued identifier, right? But we would like to have the same logon names for all systems, and the email adress must be different that way.
When i simply switch the Unique User Identifier mapping value to user.mail I'm not able to get a correct redirect to M365 when trying to login with Surname.Lastname@external-domain.de
Anyone else with those problems?
Hello, @Constantin Lotz
1) Yes, Atlassian keys everything by email. To be precise – regardless of what is specified in the mapping, i.e. one would think that as per your screenshot the unique identifier is the UPN, but no it's completely ignored, and it's the email that is being used to identify the user.
2) With the configuration in your screenshot the users should be created with emails from the external domains, despite them entering the UPN to trigger the redirect, and logging into Azure with UPN.
Is this not working?
With configuration as per your screenshot, this statement is not correct:
Within Atlassion the User will be created with the upnname and the same value will be the e-mail address value.
3) The triggering to SAML flow happens based on the claimed domains. For you to be able to enter the email with the external domain and be redirected – you need to claim that domain too in Atlassian.
What you then use to actually login into Azure is irrelevant – as soon as you are authenticated the attributes will be sent as per the mapping in your screenshot. If you claim both domains – users will be able to enter either UPN or the email at Atlassian front-door.