Atlassian Access: External Users that are not part of our domain

[Jackson Lum]

Hi,

We are interested in using Atlassian Access SSO. My organization is ACME.COM. So anyone with the email XXX@acme.com will be able to authenticate. We have a need to collaborate with external users that are not part of our domain. What are my options?

In reading the documentation online, I found:

"You can give access to users with Atlassian accounts from domains that you don't own, such as sarah@vendor.com, but those users won't be subject to the Atlassian Access policies you've set."

Is there any additional documentation related to my inquiry? I am thinking that the only option I have is setting those user up with acme.com domain accounts and password so that they could be authenticated. Is there an option for the external users to purchase their own licenses and then logon to my JIRA and Confluence Cloud?

[Dave Meyer]

Hi @Elijah Wolf ,

So I think your diagnosis of the problem is correct – we initially do a check on the domain to recognize that you should log in with SSO, but on the next login screen, that user doesn't actually haven an Atlassian account yet so they aren't automatically sent to the SSO provider.

I think the simplest way to solve this would be to set up user provisioning from Azure AD:

1. That will ensure that any new users you create will have an Atlassian account automatically

2. Provisioning from Azure AD bypasses the email verification step

The instructions to set that up are here: https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/atlassian-cloud-provisioning-tutorial

Typically the way to do this with JSM is to put all your "customer" users (i.e. non-agents) in a group. You should make sure that group is synced to the site, but is not a "product access group" for JSM, so that they don't get billed as agents. 

[Dani Perez]

Hi,

I'm having this same issue. My users are provisioned via Azure AD (SCIM) and are added automatically to Customers. SSO is enabled. Domain is linked and verified.

But, each new internal user is trying to reach the portal via SSO, gets the verification window.

How can we avoid this verification step?

Thanks

Dani

[Dani Perez]

Fixed when I checked "Enforce SSO" configuration.

[Amine Barketi]

Hello @Dave Meyer 

I am having a major issue as Elijah I am not able to access Jira my admin added me and I am not able to join the Jira platform because none of the verification code that is sent to my professional email address was reached out. Could you please assist me with my situation.

Thank you very much.