How I can config-use my single sign-on for my customers (employees)?

[Pablo Sánchez]

Hi,

I need to config my Jira Service Management (JSM) for use our Azure AD with a autentication policy with SSO. I have this configured and working fine for USERs (agents) that manage the issues, etc. for 100 "agents" (paid licence). Ex. agent1,2,3....@my-domain.com, this users uses their AD (Active Directory) credentials and loging ok.

BUT I need give an access for the rest of employees (customers) for any service project created, and all them are in the same Azure AD but they are "customers" that will use the help portal to manage their own issues.

I have added the email accounts at the "customer" option at each service project created but when the "customer" (customer1-employee1@my-domain.com) try to login at ......atlassian.net/servicedesk/customer/ - Jira sent them an email with a link to ask them for a new password ....? Then they can access BUT I need that they use the SSO to auteticate in JSM.

Could you give me some suggestion and/or help?

Thanks!

[Max Foerster - K15t · Accepted solution]

Hey @Pablo Sánchez and welcome to the community!

As far as I'm aware you have to use Atlassian Access for allowing SSO with Atlassian Cloud products in combination with your identity provider. So if you want more users, even if they are only customers, to be able to sign in using SSO you will have to include them in that setup and pay for the additional users you manage with Atlassian Access.

Best, Max

[Pablo Sánchez]

Thanks for your quick answer Max!

The problem is that today we have more than 3000 customers (employees) :'(

[Max Foerster - K15t]

Hey Pablo, okay 3k users is a lot and so the solution might not be worth it at all. 😅  Is there anything else we can support you with? Please consider accepting the answer to mark your question as resolved to other members in the community. :) 

[Daniel Kitchen]

This is such a terrible solution/response.

So I will ask again....

How do I allow my "customers" to log into a Service Desk customer portal without being forced down the SSO route and ultimately being added into the Atlassian Billable policy by default? 

[Max Foerster - K15t]

@Daniel Kitchen please remember that you are mainly dealing with other regular users of Atlassian applications in the community, so be kind. I learned a few new things about Atlassian Access and found some resources. Maybe that's a good read for you too. Have you read about the non-billable policy yet? It doesn't support SSO for users, but at least you will not pay for portal-only customers, and you don't force them down the SSO route.

• There's a non-billable policy available for Atlassian Access when you don’t want to pay for certain users. You can read more about it in the docs: Understand authentication policies - What is a non-billable policy? 
• There's also some documentation on Configure Atlassian Access SAML Single Sign-on and User Provisioning for Customer Accounts in Jira Service Management
• And most importantly, there's this gem in jira.atlassian.com: JSDCLOUD-1015 Active Directory integration for customers 

[Daniel Kitchen]

Apologies for the frustration. I did find a setting in the Service Desk project...

Account types:

Internal
"Use this setting for internal customers such as employees at your company"

This seems to be the answer for us anyway. Customers can now log-in using their atlassian account. 

[Max Foerster - K15t]

That solution sounds faster, easier, and cheaper than dealing with Atlassian Access! 😄 😉