SAML for Service Desk customers?

[Dirk Festerling]

We are using Service Desk Cloud as an internal support tool for our company users. Most of them handle their issues by email. Some make even use out of the support portal, but most don't even know the password of their accounts. Because they have been created automatically when they sent the first email.

I would like to promote the usage of our portal, offer some confluence FAQ articles there etc. But having to sign in  is a nuicance for the customers... Now I figured out that we could use Identiy-Manager to provide single sign on even to my customers, because all have email adresses with the same (managed) domain.

After talking with Atlassian license support, I understood that in future all managed accounts (even the one for Service Desk customers) will be billed with 3 USD per user and month. We have round about 200 active users in our company and I would have to create a (billed) account for everyone (if I see that somebody joined the company)... In addition, I have no idea how to handle resigned users... They keep billed unless I disable them, but since they are not part of our team, I don't know about their leave...  In the end I will have a monthly bill of at least 600 USD that keeps growing - completeley out of my control...

Obviously I can't justify the usage of Identiy-Manager under that circumstances. Are there any alternatives to use Atlassian's cloud services and still provide a smooth experience to my customers?

Thanks a lot for your input and best regards!
Dirk

[Dave Mathijs]

Hi @Andrew Wilson A managed account does not mean a licensed account. Site and product access can be managed manually or via user provisioning (SCIM).

As a verified domain is a prerequisite for SSO, this also means that all email addresses of that domain will become managed accounts by default. You cannot split 1 domain into part managed, part non-managed accounts.

Please note that external users (i.e. external users having an email address NOT on your domain) wil not become managed as they will use their Atlassian account credentials to login and will NOT use SSO.

[Andrew Wilson]

Hi @Dave Mathijs  Thank you so much for answering!

The issue is we are a higher education establishment, meaning students, faculty staff etc all may use Atlassian products already elsewhere.  We've got 3k accounts already (only 2 of them are needed for the new jira site!) , and it looks like we cannot even progress setting up SAML or implementing security policies till we claim the existing accounts - the domain is verified, but all the SSO pages state it's not verified, assuming due to us not claiming accounts yet.  (at which point they will receive a message saying this) - plus we don't want to be responsible for managing the rest!

Think we might need to go back to the drawing board...

[Dave Mathijs]

Maybe this article can clear things up:

https://support.atlassian.com/security-and-access-policies/docs/understand-authentication-policies/