Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Earn badges and make progress

You're on your way to the next level! Join the Kudos program to earn points and save your progress.

Deleted user Avatar
Deleted user

Level 1: Seed

25 / 150 points

Next: Root


1 badge earned


Participate in fun challenges

Challenges come and go, but your rewards stay with you. Do more to earn more!


Gift kudos to your peers

What goes around comes around! Share the love by gifting kudos to your peers.


Rise up in the ranks

Keep earning points to reach the top of the leaderboard. It resets every quarter so you always have a chance!


Come for the products,
stay for the community

The Atlassian Community can help you and your team get more value out of Atlassian products and practices.

Atlassian Community about banner
Community Members
Community Events
Community Groups

Migrating to SAML. Test environment, and user logout questions.

Hi Everyone,


I am looking to migrate my organisation to use SAML single sign on, specifically with Azure AD, and have some a couple questions about the process.

One, is is possible to have some test environment, to ensure that SAML is working correctly, without affecting my users logins? Since Atlassian Access is configured organisation wide, I can't create a separate site to test in, can I?

Two, since user sessions will persist through the migration to SAML (as far as I have gathered from the documentation), will I need to have my users log out, then log back in before I would be able to manage their access through my identity provider (Azure AD)? If a user hasn't logged in with SAML, I would think that their session is not associated with their account on the ID provider. Or is the ability to disable users from the ID provider only available once I set up user provisioning?




2 answers

2 accepted

1 vote
Answer accepted
Narmada Jayasankar
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
Aug 08, 2019 • edited

Hi Harry,

Following up on the second half of your question - setting up SAML will not terminate existing user sessions. SAML SSO will kick in when the user logs out and logs back in. At that time, if the user is disabled in the IDP, the log-in attempt will be rejected. If you want access to be revoked immediately after the user is disabled in the IDP, user provisioning via SCIM is what you need. Let me know if this answers your question.



Hi Narmada,

Not everyone in my company needs an Atlassian account, so would it be possible to set up SCIM to allow me revoke access immediately via the IDP, but not actually provision new users if they log in with an email on my verified domain?

If this isn't possible, then is there a way to force log out a user as an admin?



It looks like this is possible by controlling the "app assignments" in Azure AD, so that's all I need to know. Thank you for your help.

1 vote
Answer accepted
Dave Meyer
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
Aug 08, 2019

Hi Harry,

Apologies for the delay in getting back to you. Yes, you’re correct that creating a separate test site won’t have any effect since SAML is configured for your organization based on n the domains that you have claimed. Our recommended method for testing is to verify a test domain for your organization, like “” and create a couple users in Azure AD with emails on that domain. Then go ahead and configure SAML with Azure AD and you can test it out with those users. Once you’re satisfied, you can go ahead and verify your production domain and the SAML settings will automatically apply to all users on your production domain, across all sites they access.

I will check with our team about your question on sessions.



Using another domain to test will help, thank you for the suggestion.

I look forward to hearing back from you about user sessions.



I was looking forward for a same solution. Having Azure Ad SAML. Any document that can help me setting this up please?

Suggest an answer

Log in or Sign up to answer
AUG Leaders

Atlassian Community Events