Is SAML a global change or will it only effect users added to Azure AD Enterprise App?

[Edwin Lloyd-Jones]

I have recently started at a new company and they have a project where they want to use Jira Software, Confluence and Trello.  I have never used these applications before so trying to get my head round how it all works.  All our users are Microsoft O365 licensed and I would like to user SAML authentication via Azure AD going forward.

I signed up to the free trial of Atlassian Access and have verified our domain which produced a report of users that already have Atlassian accounts and what platforms they have accessed.  Most of these users use it to access other 3rd party Jira and Confluence implementations and won't be part of the company specific instance.

In principal I am fine with claiming those users into Access as an Admin it is good to get some visibility of what people have access to and also to delete users that have left the company.  However I have a couple of things I am unsure on and hoping someone can help clarify.

1/ If I enable SAML will it change it for all users or just the users I assign to the Azure AD Enterprise Application?  Essentially enabling a split login some users on SAML some using Atlassian username and password.

2/ My assumption based on other questions asked in the forum is that if the users do all switch to SAML it has no impact on their access to 3rd Party Jira and Confluence platforms it just changes their login screen.  I guess what I am asking is do I need to ask those 3rd Parties to do anything on their end.

Thanks for any help you can offer.

[Dave Meyer]

Hi @Edwin Lloyd-Jones 

If I enable SAML will it change it for all users or just the users I assign to the Azure AD Enterprise Application?  Essentially enabling a split login some users on SAML some using Atlassian username and password.

When SAML is enabled it is enforced on all managed accounts on your domain, so all user will be redirected to Azure to log in. If they are not assigned to the Azure AD Atlassian Cloud application, they will not be able to log in. If you need to test SSO before rolling it out to all users, we recommend you set up a separate organization, verify a test domain (like test.acme.com) and test out SSO with a dummy user with an email address on that domain.

My assumption based on other questions asked in the forum is that if the users do all switch to SAML it has no impact on their access to 3rd Party Jira and Confluence platforms it just changes their login screen.  I guess what I am asking is do I need to ask those 3rd Parties to do anything on their end.

That's exactly correct, it only changes how users log in and does not affect their access to any individual tenant. There isn't necessarily any reason why you would need to contact the administrators of those instances.

Hope this helps.

Dave