Azure AD SSO with Existing Jira Impact

[michael.gorbachep]

Context : Our organization have used JIRA in the last 4 years using the org email, but with their own password. This year, we establish our Azure AD in our company.

Question : 1. How do we do the SSO between JIRA and Azure AD?
2. Would this activity impact our current board? Since the same email has used before in every task and board.

Update Feb 2023 still no answer

[ferrari · Accepted solution]

Question 1: These docs walk through the integration for SSO with Azure AD:

• https://support.atlassian.com/security-and-access-policies/docs/configure-saml-single-sign-on-with-an-identity-provider/
• https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/atlassian-cloud-tutorial

You will need an Atlassian Access subscription. If you haven't explored Access I recommend starting with this guide. https://www.atlassian.com/software/access/guide/organizations-domain-claim

Question 2: I'm not sure what you mean by will this activity impact your current board. As long as the users will keep the same email between their existing Atlassian Accounts and the emails that will be used in Azure AD your tasks and boards should not be affected. 

[Ed Letifov _TechTime - New Zealand_]

Hello, @michael.gorbachep 

Atlassian Access is a "gateway" to Atlassian Cloud, all of it – any Jira or Confluence instance, yours, or belonging to others, Trello, this very Community site... Just like Atlassian ID (their own login page) was before you implemented integration with Azure AD.

If you show up at the Atlassian's front door (the login page), and enter your org email – before you were asked for the password by Atlassian, now you will be redirected to Azure AD, so it can authenticate you (e.g. ask for the password), then you will be redirected back to Atlassian.

If you were trying to access some resource (by clicking on a direct link e.g. to your board), you would be sent to Atlassian login page to go through the process above, and once finished, proceed to the resources you were after.

If you are already logged in on Azure AD side – all these redirects while they still happen will usually not result in the password authentication being requested, achieving "SSO on the web".

So, if your emails are the same, from Atlassian's point of view these are the same users, whether they are coming via password authentication at Atlassian level (as before) or via Azure AD.