JSM portal-only customers SSO with Entra ID redirects to login.live.com

[Julien Béchade]

Hi,

I'm a bit puzzled. I followed this guide https://confluence.atlassian.com/cloudkb/configure-saml-single-sign-on-for-portal-only-customers-with-entra-id-formerly-known-as-azure-ad-1541081409.html to set up SSO for portal-only customers but it always redirects to https://login.live.com/oauth20_authorize.srf and not to our actual Entra ID login page.

I went over the guide many times to make sure I did not omit something or made a mistake. The request is actually reaching https://login.microsoftonline.com/{{uuid}}/saml2, the entreprise app. login URL, but is redirected to login.live.com from there so the issue is definitively in Entra ID.

Did anybody stumble upon this issue and resolved it?

[Marc - Devoteam]

Hi @Julien Béchade 

You could look at this previous community post

https://community.atlassian.com/forums/Jira-Service-Management/Portal-only-customer-SSO-with-Azure-B2C/qaq-p/2738020

[Julien Béchade]

This is gold, thank you @Marc - Devoteam

[Julien Béchade]

That article https://www.camiloterevinto.com/post/azure-b2c-atlassian-sso listed on the post you linked to was very informative and straight to the point.

[Marc - Devoteam]

Hi @Julien Béchade 

Please accept my answer as a solution, if my answer helped to solve or provide a workaround to your request.

This will help other community member trying to solve the same or provide them with a work around

P.S. If the answer is very valuable to you, please share some kudos.

[Julien Béchade]

Happy to @Marc - Devoteam! But both answers are correct and helped me a lot.

[Christos Markoulatos]

Hi @Julien Béchade 

This happens because of Home Realm Discovery (HRD) in Microsoft Entra ID. When a user enters an email address that Entra doesn’t recognize as part of your managed domains (for example, @gmail.com or @outlook.com), Entra assumes it’s a Microsoft Account (MSA) and sends the user to the consumer login service at login.live.com.

The Atlassian guide you followed sets up SAML SSO using an Enterprise App in your workforce tenant. That works perfectly for your employees or guests in your tenant, but it cannot authenticate random external users unless they exist in your tenant or you use a customer identity solution.

Option 1: B2B (Guest users in your tenant)

• Invite external customers as guests in your Entra tenant (or enable self-service sign-up).
• They can sign in with their Microsoft Account or their own Entra account.
• Your Enterprise App will then issue the SAML assertion to Atlassian.

Option 2: External ID / B2C

• Use Microsoft Entra External ID (B2C) for a true customer-facing identity solution.
• B2C supports:
  • Microsoft Accounts (MSA)
  • Social logins (Google, Facebook, etc.)
  • Local accounts
• Atlassian accepts any SAML 2.0 IdP, so you configure Atlassian to trust your B2C policy endpoints (which look like https://<tenant>.b2clogin.com/...).

For true external customers, you need B2B or B2C.

Microsoft Entra B2B best practices and recommendations - Microsoft Entra External ID | Microsoft Learn

What is Azure Active Directory B2C? | Microsoft Learn

Hope this helps 😊

[Julien Béchade]

Hi Christos,

Thank you for taking the time to answer! This definitively helps 🙏

It does make sense that an entreprise app. is scoped to the managed domain.
But we happen to have a B2C tenant so option 2 it is.
However, I'm not sure how to "configure Atlassian to trust your B2C policy endpoints" to match Atlassian requirements. Any pointers?

[Julien Béchade]

Ok so it looks like I would first need to create a SAML app. in B2C following this guide https://learn.microsoft.com/en-us/azure/active-directory-b2c/saml-service-provider?tabs=windows&pivots=b2c-custom-policy. Am I on the right track?