How to manage multi-tenant access with third-party SSO

[Ryan Gibbons]

We have an Org with multiple tenants beneath it representing different functional areas of the organization. One tenant would like to use SSO for their users with JIT Provisioning.

Is there a way to enable Atlassian Access for a single tenant or a subset of users?

-

Is there a way to enable JIT Provisioning with a third party IdP to allocate new users and deactivate old users using IdP Initiated service calls?

[Dave Meyer]

Hi @Ryan Gibbons 

> Is there a way to enable Atlassian Access for a single tenant or a subset of users?

Atlassian Access is a subscription for an organization, which can span many tenants, so it's not possible to enable it for a single tenant. But you can set up different authentication policies for different subsets of users https://support.atlassian.com/security-and-access-policies/docs/understand-authentication-policies/

If you have users that you don't want to include under any Atlassian Access subscription, see the information on that page about nonbillable authentication policies.

> Is there a way to enable JIT Provisioning with a third party IdP to allocate new users and deactivate old users using IdP Initiated service calls?

Yes, see the info about JIT here https://support.atlassian.com/security-and-access-policies/docs/configure-saml-single-sign-on-with-an-identity-provider/#Just-in-time-provisioning-with-SAML