Come for the products,
stay for the community

The Atlassian Community can help you and your team get more value out of Atlassian products and practices.

Atlassian Community about banner
Community Members
Community Events
Community Groups

Migrating to SAML. Test environment, and user logout questions.

Hi Everyone,


I am looking to migrate my organisation to use SAML single sign on, specifically with Azure AD, and have some a couple questions about the process.

One, is is possible to have some test environment, to ensure that SAML is working correctly, without affecting my users logins? Since Atlassian Access is configured organisation wide, I can't create a separate site to test in, can I?

Two, since user sessions will persist through the migration to SAML (as far as I have gathered from the documentation), will I need to have my users log out, then log back in before I would be able to manage their access through my identity provider (Azure AD)? If a user hasn't logged in with SAML, I would think that their session is not associated with their account on the ID provider. Or is the ability to disable users from the ID provider only available once I set up user provisioning?




2 answers

2 accepted

1 vote
Answer accepted

Hi Harry,

Following up on the second half of your question - setting up SAML will not terminate existing user sessions. SAML SSO will kick in when the user logs out and logs back in. At that time, if the user is disabled in the IDP, the log-in attempt will be rejected. If you want access to be revoked immediately after the user is disabled in the IDP, user provisioning via SCIM is what you need. Let me know if this answers your question.



Hi Narmada,

Not everyone in my company needs an Atlassian account, so would it be possible to set up SCIM to allow me revoke access immediately via the IDP, but not actually provision new users if they log in with an email on my verified domain?

If this isn't possible, then is there a way to force log out a user as an admin?



It looks like this is possible by controlling the "app assignments" in Azure AD, so that's all I need to know. Thank you for your help.

1 vote
Answer accepted
Dave Meyer Atlassian Team Aug 08, 2019

Hi Harry,

Apologies for the delay in getting back to you. Yes, you’re correct that creating a separate test site won’t have any effect since SAML is configured for your organization based on n the domains that you have claimed. Our recommended method for testing is to verify a test domain for your organization, like “” and create a couple users in Azure AD with emails on that domain. Then go ahead and configure SAML with Azure AD and you can test it out with those users. Once you’re satisfied, you can go ahead and verify your production domain and the SAML settings will automatically apply to all users on your production domain, across all sites they access.

I will check with our team about your question on sessions.



Using another domain to test will help, thank you for the suggestion.

I look forward to hearing back from you about user sessions.



I was looking forward for a same solution. Having Azure Ad SAML. Any document that can help me setting this up please?

Suggest an answer

Log in or Sign up to answer
Community showcase
Published in Atlassian Access

Atlassian Access Demo Q&A Recap

Hi Community! Thank you to all who joined our ongoing monthly Atlassian Access demo! We have an engaging group of attendees who asked many great questions. I’ll share a recap of frequently ask...

1,153 views 4 4
Read article

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you