How to manage multi-tenant access with third-party SSO

[Ryan Gibbons]

We have an Org with multiple tenants beneath it representing different functional areas of the organization. One tenant would like to use SSO for their users with JIT Provisioning.

Is there a way to enable Atlassian Access for a single tenant or a subset of users?

-

Is there a way to enable JIT Provisioning with a third party IdP to allocate new users and deactivate old users using IdP Initiated service calls?

[Dirk Ronsmans · Accepted solution]

Hey @Sajit Nair ,

You need to first understand the difference between claiming a domain and making them managed accounts vs using Atlassian Access.

While Access needs managed accounts, claiming a domain does not mean they all will be using access.

https://support.atlassian.com/user-management/docs/what-are-managed-accounts/

https://support.atlassian.com/user-management/docs/manage-your-organizations-atlassian-accounts/

So step one would be to claim the domain and claim the accounts. (this is free/included in your instance subscription)

After that you can trial/enable Atlassian Access and create a separate Authentication Policy (https://www.atlassian.com/software/access/guide/authentication-policies) for those 6-7 users. On that policy you can enable SSO/MFA then but the other users which remain in the default policy will not notice anything.

[Sajit Nair]

Thank you @Dirk Ronsmans