Issues migrating from G Suite to SAML SSO Azure AD

[jason.chau]

Hi Atlassian Community,

I'm having issues with this process and I've got no idea what's going on.

Here are the steps I'm following:

1. Disconnecting G-Suite: https://community.atlassian.com/t5/Atlassian-Account-articles/Migrating-from-G-Suite-to-other-Identity-Providers-Okta-Azure-AD/ba-p/1275211
2. Verify domain and claim accounts (on a Atlassian Access trial): https://confluence.atlassian.com/cloud/verify-a-domain-for-your-organization-873871234.html
3. Setup SAML: https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/atlassian-cloud-tutorial

I disconnect G-Suite fine, I verified our domain fine (GoDaddy) but when I try to claim accounts there are none to claim. All the users in our tenant have the same domain address that I've verified. The only strange thing is when I verify a domain I have to type in the full address, ie www.domain.com rather than domain.com. This shouldn't make a difference right? I've triple checked my TXT entries (using @ as name).

Any ideas?

[Jimmy Seddon]

Hi @Bob Sochacki,

We are also using Azure AD with SSO enabled, to be honest I haven't tried this myself, we use the default of 30 days.  I have no problems setting this to 4 hours, exiting when I'm done tonight letting you know what happens tomorrow morning when I try to login.

Stay tuned I'll get back to you on this one.

-Jimmy

[Bob Sochacki]

Thanks!

[Jimmy Seddon]

Hi @Bob Sochacki,

Ok so I changed the idle timeout setting, I exited Jira to reset my session duration, then I logged back in.  I left that overnight and when I reloaded my view this morning I was required to log back in.  So I would say this is working correctly.

It's worth noting that my browser regularly asks if I want to stay signed in when I'm logging in into my Azure AD account and I always say no, is it possible that you have said yes to this and that is why you aren't seeing your session expire?

Just a thought.  From here you might need to open a support request to see what's going on behind the scenes.

Sorry I can't offer much more help than that.

-Jimmy

[Bob Sochacki]

Hi @Jimmy Seddon  did you close your browser when you tested this or just close the tab for Jira?

[Jimmy Seddon]

Hi @Bob Sochacki,

I closed the browser when I logged out to update the session timeout setting (changing to 4 hours) then I opened my browser again logged into Jira and left the browser and the tab open overnight.  The I reloaded the back in the morning and I saw the SSO prompt because my session had expired.

-Jimmy

[Bob Sochacki]

@Jimmy Seddon  I think our configs might be different.  When I opened my browser and hit my favorites button for Jira, I get this and then I have to click on the arrow in the upper right to login.   If we leave Jira or the browser open we stay logged in.

[Jimmy Seddon]

@Bob Sochacki I think you may be correct that our configuration is different because you are correct that is not the same thing that I'm seeing.

[Bob Sochacki]

@Jimmy Seddon Do you know if logout is required  for each user for the idle time setting to go into effect for each user

[Jimmy Seddon]

Hi @Bob Sochacki,

Based on the message displayed on the configuration screen, I believe this setting will require each user to logout before the update takes effect.

-Jimmy