Billing for SSO for a small group in an organization?

[Jeffrey Preletz]

I'd like to set up Jira SSO for our organization, but am confused on how the billing structure works. If I use Guard to provision users with Azure AD (Entra ID), we have many users in the directory, but only a handful of developers will user the Jira. Obviously, I'd prefer that our company is only billed for authorized users in the development group instead of the entire directory. Is there some guidance I'm missing on how this works?

[Marc - Devoteam · Accepted solution]

Hi @Jeffrey Preletz 

Only user with active licenses will be billed.

So even if you have all your users from your org within Atlassian Guard, only the users with  an active license on a product are billed.

Users with no product access are not billed.

There is one exception, if you claim your company domain, you could find that any of your users could your a free tier instance of a Atlassian product, theses users will then count towards your Guard bill.

Also if they have access to Jira instances you don't manage or own. If they are granted access with their org email address

[Jeffrey Preletz]

Marc,

Thanks for quick reply! Please correct me if I'm wrong, but in order to activate SSO, it looks like claiming a domain is a prerequisite. Is that not correct?

Also, SSO should be managed through group claims. So only assigned group(s) should be authorized to access resources - not everyone in the directory - regardless of license. Does Guard not respect group claims?

[Marc - Devoteam]

Hi @Jeffrey Preletz 

Correct.

No within SSO claim you can sync users and/or groups.

But access to products is based on users, not groups.

This to prevent costs, If you forgot to remove users from a group they would still have access and be billed.

[Jeffrey Preletz]

Marc,

Perfect. And exactly the answer I was looking for.

Thank you!