I am looking to migrate my organisation to use SAML single sign on, specifically with Azure AD, and have some a couple questions about the process.
One, is is possible to have some test environment, to ensure that SAML is working correctly, without affecting my users logins? Since Atlassian Access is configured organisation wide, I can't create a separate site to test in, can I?
Two, since user sessions will persist through the migration to SAML (as far as I have gathered from the documentation), will I need to have my users log out, then log back in before I would be able to manage their access through my identity provider (Azure AD)? If a user hasn't logged in with SAML, I would think that their session is not associated with their account on the ID provider. Or is the ability to disable users from the ID provider only available once I set up user provisioning?
Apologies for the delay in getting back to you. Yes, you’re correct that creating a separate test site won’t have any effect since SAML is configured for your organization based on n the domains that you have claimed. Our recommended method for testing is to verify a test domain for your organization, like “test.yourdomain.com” and create a couple users in Azure AD with emails on that domain. Then go ahead and configure SAML with Azure AD and you can test it out with those users. Once you’re satisfied, you can go ahead and verify your production domain and the SAML settings will automatically apply to all users on your production domain, across all sites they access.
I will check with our team about your question on sessions.
Following up on the second half of your question - setting up SAML will not terminate existing user sessions. SAML SSO will kick in when the user logs out and logs back in. At that time, if the user is disabled in the IDP, the log-in attempt will be rejected. If you want access to be revoked immediately after the user is disabled in the IDP, user provisioning via SCIM is what you need. Let me know if this answers your question.
Not everyone in my company needs an Atlassian account, so would it be possible to set up SCIM to allow me revoke access immediately via the IDP, but not actually provision new users if they log in with an email on my verified domain?
If this isn't possible, then is there a way to force log out a user as an admin?
Based on your valuable feedback, we have released several new features to help you gain administrative flexibility with authentication policies, visibility into shadow IT with automatic product disco...
Connect with like-minded Atlassian users at free events near you!Find an event
Connect with like-minded Atlassian users at free events near you!
Unfortunately there are no Community Events near you at the moment.Host an event
You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events