Implementing Atlassian Access, do I need an admin 'back door'?

[John Hadaway]

Hi, We have existing cloud Confluence and Jira products and intend to implement Atlassian Access, is there any risk that enabling Atlassian Access will block existing user access, specifically including the admin accounts.  In essence if my admin account fails authentication I'll be locked out and unable to resolve the user access issues.  I'm assuming that Atlassian Access is designed to avoid this scenario, but assumptions are bad things in our line of work.

We have a locally authenticated admin account on our Confluence server environment, is there an equivalent for cloud hosted (or no requirement for one).

Oh and hey, just to up the 'fun factor' we're going to enable Atlassian Access tomorrow (21/06/2022).  Why not eh, I mean... what could go wrong?

Aha, I've just realised that cloud admin is via admin.atlassian.com, rather than via our cloud site.  I'm thinking this neatly avoids the 'I'm an admin locked out of my own site' issue?  Do others agree?

[Dave Meyer]

@John Hadaway implementing SSO with Atlassian Access does not change what user accounts have permissions to access, but we do see customers misconfigure SSO and get locked out of their account.

The best way to avoid this is to use authentication policies. Set up a new authentication policy to test out your SSO configure with just one or a few users, then once you know it's working you can assign all your users to that authentication policy. You can also keep a "backdoor" authentication policy for an admin account just in case, this is a pretty common use case.