Best practice for managing multiple departments sharing a single SSO domain

Question

I'm a little confused over thepurpose of an Atlassian organization and how an organization relates to a company domain.

Both my department and another department within my company plan to use Jira & Confluence in a new Atlassian Cloud instance. We will be only supporting SSO users.

I would like to be able setup a scheme where each department can create, control & setup access to their own Jira apps and Confluence spaces without having access to the other departments Jira apps and confluence spaces. The access would be granted using Atlassian security groups.

Also, it's possible that the same user will need to access Jira/Confluence apps/spaces across more than one department.

What's the best way to accomplish all this?

Does is make sense to create an Atlassian Organization for each department?

Can more than one Organization both share the same SSO domain?

I'm not sure that I completely understand the concept of managed users. Can more than one organization assign security to the same SSO user?

I read online that a managed user can only be claimed by a single organization. Do I need to claim a user in order to add them to a security group and/or change their security access?

Ed Letifov _TechTime - New Zealand_ · Answer

@Tamas Hajdu

To be precise: SSO is not limited to auto-claim one. If an existing account is claimed by an org, and is in the SSO policy in that org – SSO will work, regardless if the org is the auto-claim one or not.

Auto-claim is affecting new accounts – when someone shows up in Cloud for the first time and enters their email in Atlassian login page – it's the auto-claim org that will claim them. If in this org they fall into SSO policy e.g. by the policy being linked as the default for the domain – then the SSO will be attempted.

Tamas Hajdu_5p7dri · Answer

Hi,

I think the training materials and the exam materials had not yet been updated with this, and they state that only one ORG can verify a domain....

:-) I can verify that the multiple verification works, with the fact that only one org can manage a given account. SSO will work only with the org set to auto claim, the other orgs will SSO through but if GUARD is present, the accounts managed elsewhere will be considered external (fun fact, even will have to enter the mfa email code if that is set for externals).

Tamas

Craig Castle-Mead_20fp9z · Answer

Hi @Alan Farkas

I would recommend one Atlassian org to manage the authentication of users (required at the moment as access only supports a single org to claim a domain, but as @Aneita @mentioned, they’re looking to release support for one domain to be split over multiple orgs). The management of the users and authentication policies does not necessarily have to relate to how the products are used (managed and billed) though, so my suggestion is (given your stated requirement that each department can manage (admin/billing) of their products:

- one org that manages your entire domain and its SSO. Users would have to be granted access to this org to login to anything within the Atlassian Cloud world. This org would get the bill for the SSO/SAML component. 
 - one org for each department. These orgs would not manage your users/saml, but the products (Jira/conf/etc) related to their department. As product admins for all products within their org, they would be able to assign users (from the central org) to their products, and would be billed for those products.

CCM