Davide D'Alessandro1/Italy/IBM having issue while sign up in atlassian

[Priyanka Baliyan]

He can successfully access and login to the atlassian.com website with my IBM ID/pwd 

but He is not able to access https://ibmgaia.atlassian.net/secure/Dashboard.jspa..his name is not showing while adding in my project (RMT).

Can you please help us

[Darryl Lee]

Great question - I don't think Atlassian has ever had a definitive answer about the B2B that we also wanted way back when:

https://community.atlassian.com/t5/Atlassian-Guard/Will-Atlassian-Access-work-for-B2B-Guest-users-in-our-Azure-AD/qaq-p/1898496

There's discussion in there about External User Security and 2FA, but I believe that only applies to External Users who are not otherwise onboarded into Atlassian, and the 2FA is managed by Atlassian, not Azure/your IdP:

https://support.atlassian.com/security-and-access-policies/docs/available-external-user-security-settings/

[Darryl Lee]

My sense is that this is going to be problematic as long as Atlassian insists on being ... what's the right word... a shadow IdP?

That is, THEY are the ones dictating who "owns" a domain, so if ACME.COM has not signed up for Atlassian Cloud and claimed their domain, they don't want to allow YOURCOMPANY.COM to delegate authentication for an account in that domain.

The thread above, and this olde one (https://community.atlassian.com/t5/Jira-questions/Can-Azure-AAD-Guest-Users-log-in-with-Atlassian-Access/qaq-p/1166039) talk about how the Guest Users are actually provisioned as:

test1_somedomain.com#EXT#@verifieddomain.com

Which won't work as a valid e-mail address/account.

And if you try to provision user@ACME.COM, and again, ACME.COM is not an Atlassian Cloud customer, then those user@ACME.COM will end up with a "local" Atlassian account.

[andrew.jones]

@Dave Meyer any update?

[DG]

@Dave Meyer is there any update in this case?

[David Olive]

Hi all!

We just released an enhancement to external user security which allows you to enforce SSO on external users. This should work for any externals in your Azure AD.

You can read more details about the feature and see a demo video of the feature here.

Let me know if you have any questions!

All the best,
-David

[Julien Béchade]

Hi @David Olive

Unfortunately, it does not seem to work for Azure AD federated users.
I assume it's because their UPN is actually not their e-mail address but looks like this instead firstname.lastname_federateddomain.com#EXT#@mydomain.onmicrosoft.com.

Do you have a way forward with this?

Cheers.

Julien.

[mdidde]

Is there any update on the above? We're also facing similar issues.  @David Olive