Configure SAML for Atlassian with Okta

[Iris Ayelin]

Hi,

We are about to enable SSO with Okta in Atlassian.

At this point, we manage two environments in Atlassian, which means the users in Jira/Confluence are not the same as the users in Bitbucket.

In the setup guide, I saw we need to subscribe to Atlassian Access.

My question is if we'll subscribe to this app it will work on both the environments - Bitbucket and Jira/Confluence? 

Thank you! 

[Theodora Boudale]

Hi @Iris Ayelin,

If both Jira/Confluence users and Bitbucket users have an account with an email from one of your verified domains, then SAML SSO can be enforced for all of them. However, it is also possible to enforce SAML SSO for some users and not for others.

If you subscribe to Atlassian Access, there will be an option in https://admin.atlassian.com/ (for Org Admins) called Authentication policies. You'll need to configure and save SAML and then enforce SAML single sign-on in an authentication policy.

In case you want to enforce SAML SSO for some users but not for others, you can have two authentication policies: one with the setting Enforce single sign-on disabled, and another one with this setting enabled. You can then add different users to each of these policies.

Otherwise, you can use one authentication policy with Enforce single sign-on enabled, and all users will need to log in with SAML SSO.

You can take a look at the following video for a brief introduction to Authentication policies:

• https://www.youtube.com/watch?v=jSAnfAC5dmU&ab_channel=Atlassian

Here are some links from our documentation:

• https://support.atlassian.com/security-and-access-policies/docs/configure-saml-single-sign-on-with-an-identity-provider/#Configure-and-enforce-SAML-single-sign-on-with-authentication-policies
• https://support.atlassian.com/security-and-access-policies/docs/understand-authentication-policies/

Kind regards,
Theodora