Can JSM Cloud use SAML single sign on from AD as well as the Atlassian Identity management?

[Sarah Catania]

Hi there

We recently moved (May 2021) from the Jira Service Desk Server Platform to Jira Service Management Cloud (JSM) and through our migration we were advised that we can't use both SAML Single sign on AND the induilt Atlassian Identity Management.

(I may be getting my terms muddled as I am no JIRA admin, so apologies for that).

We have internal agents (users) who have accounts within our Azure AD and also have external people who need access to our Atlassian software (Confluence, JIRA and JSM). Is this possible?

TL;DR: Can we have internal AD accounts and external accounts created on our JIRA Service Management cloud instance?

[Ed Letifov _TechTime - New Zealand_ · Accepted solution]

Short answer: yes

The advice of not being able to mix both SAML SSO and in-build Atlassian ID mostly relates to agents and even then is not correct anymore.

If you want SAML SSO, you have to purchase and configure Atlassian Access, that allows to integrate Atlassian ID with an external SAML Identity Provider based on verified domains – if the domain is yours, and you have Access enabled and integrated with SAML IdP, the user from this domain will be send to the IdP for authentication. This used to mean that all agents from your domain will have to go via SAML IdP.

However Access now supports "Authentication Policies" (https://support.atlassian.com/security-and-access-policies/docs/understand-authentication-policies/) that can be used to allow some managed users to authenticate directly i.e. with Atlassian ID

JSM customers is another matter – they were always internal to the instance (not even Atlassian ID), i.e. if you had two Cloud sites, both with JSM - the same person would have to register twice (even if with the same email) and could have different passwords. This applies to people from your domain too, even if they have Atlassian ID account.

To let them use their Atlassian ID account (and thus follow Access policies e.g. SAML or 2FA) one needs to migrate a JSM customer to Atlassian ID (see https://support.atlassian.com/user-management/docs/manage-jira-service-management-customer-accounts/). Unfortunately this remains a manual admin process.