Are you in the loop? Keep up with the latest by making sure you're subscribed to Community Announcements. Just click Watch and select Articles.

Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Earn badges and make progress

You're on your way to the next level! Join the Kudos program to earn points and save your progress.

Deleted user Avatar
Deleted user

Level 1: Seed

25 / 150 points

Next: Root


1 badge earned


Participate in fun challenges

Challenges come and go, but your rewards stay with you. Do more to earn more!


Gift kudos to your peers

What goes around comes around! Share the love by gifting kudos to your peers.


Rise up in the ranks

Keep earning points to reach the top of the leaderboard. It resets every quarter so you always have a chance!


Atlassian Access & Azure AD SSO / Provisioning with different UPN Name & E-Mail Adress not possible?

Hi there,


i've an azure ad tenant withe the following user layout:

User principle Name =
E-Mail Adress =

So our logon name at M365 is always the upnname (

We've setup the SSO Connection, authentication works within Atlassion. When entering as username we'll be redirected to M365 login. But the user mapping is not correct.

Within Atlassion the User will be created with the upnname and the same value will be the e-mail address value. But I expect the real E-Mail Address to be that value which is the user.mail Attribute within Azure.

2022-12-15 10_53_36-Window.png

I think the problem is, that atlassian only handles the e-mail adress as uniqued identifier, right? But we would like to have the same logon names for all systems, and the email adress must be different that way.

When i simply switch the Unique User Identifier mapping value to user.mail I'm not able to get a correct redirect to M365 when trying to login with

Anyone else with those problems?

Kind regards,


1 answer

1 accepted

1 vote
Answer accepted
Ed Letifov _TechTime - New Zealand_
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
Dec 17, 2022

Hello, @Constantin Lotz 

1) Yes, Atlassian keys everything by email. To be precise – regardless of what is specified in the mapping, i.e. one would think that as per your screenshot the unique identifier is the UPN, but no it's completely ignored, and it's the email that is being used to identify the user.

2) With the configuration in your screenshot the users should be created with emails from the external domains, despite them entering the UPN to trigger the redirect, and logging into Azure with UPN.

Is this not working?

With configuration as per your screenshot, this statement is not correct:

Within Atlassion the User will be created with the upnname and the same value will be the e-mail address value.

3) The triggering to SAML flow happens based on the claimed domains. For you to be able to enter the email with the external domain and be redirected – you need to claim that domain too in Atlassian.

What you then use to actually login into Azure is irrelevant – as soon as you are authenticated the attributes will be sent as per the mapping in your screenshot. If you claim both domains – users will be able to enter either UPN or the email at Atlassian front-door.

Ok thanks a lot, i guess it was the thing that we have to claim both domains :-)

Suggest an answer

Log in or Sign up to answer
AUG Leaders

Atlassian Community Events