SSO
Asked by Bakhtawar Tanveer:

Hi Community,

We just recently started use JSM and plan to have 20 agents and internal 280\~500 customers. Now we want SSO for users.

What should I do next? Can we use Access and what about pricing of it? Hope I can get a broad pic of the whole any reference links would be appreciated. Thanks.


Answers:
author: Zoey Wang
body: Hi [@Bakhtawar Tanveer](/t5/user/viewprofilepage/user-id/5442019)

Welcome to the Atlassian Community!

Yes Access is the way to go to enable your SSO for the users.

1. Check here [Manage your bill for Atlassian Access](https://support.atlassian.com/subscriptions-and-billing/docs/manage-your-bill-for-atlassian-access/#)

It tells what kind of user is identified as a billable user - as overall the billing cost depends on the number of unique billable users; and billing cycles - monthly vs annual

2. If your internal customers have no product access yet, they won't be considered as billable users. Hence no cost associated with this number of users.

3. If you check the link below you can find SSO configuration steps.

[Atlassian Access policies and features](https://support.atlassian.com/security-and-access-policies/docs/understand-atlassian-access/) apply to all the managed users with access to JSM in your case.

For internal users
> SAML single sign-on for your organization's users:
>
> <br />
>
> If you'd like your users to authenticate through your company's identity provider when they log in to your Atlassian cloud products, you can set up SAML for single sign-on (SSO). SSO allows a user to authenticate with one set of login credentials and access multiple products during their session.
>
> With SSO, you have a few benefits:
>
> If self signup is enabled, we automatically create an Atlassian account for them when that user logs in for the first time with SSO.
>
> You can set security policies from your identity provider that will apply when users log in to your Atlassian products
>
> <br />
>
> <br />

comments: author: Bakhtawar Tanveer
body: Thanks [@Zoey Wang](/t5/user/viewprofilepage/user-id/4512393) for such a prompt reply!

Will read thru quickly and see if any further questions need your help.


author: Ed Letifov _TechTime - New Zealand_
body: Hello, [@Bakhtawar Tanveer](/t5/user/viewprofilepage/user-id/5442019)

As [@Zoey Wang](/t5/user/viewprofilepage/user-id/4512393) (hello Zoey!) specified -- yes you should use Atlassian Access. To be clear -- there is no other option, as Atlassian doesn't allow any 3rd party SSO solutions in Cloud.

Just make sure you set up the integration with your IdP correctly!

I do not know what IdP you are using, but here are some answers that I've previously provided related to Azure AD:

* <https://community.atlassian.com/t5/Jira-Service-Management/Re-Azure-AD-login-and-incoming-email-not-matching-up/qaq-p/1821878/comment-id/88619#M88619>
* A longer rant: <https://community.atlassian.com/t5/Atlassian-Access-questions/Re-Re-Integrate-Azure-AD-with-Atlassian-Cloud/qaq-p/1862549/comment-id/3417#M3417>
* <https://community.atlassian.com/t5/Atlassian-Account-questions/Re-SAML-SSO-with-Azure-AD-does-not-work-when-using-quot-Cont/qaq-p/2086465/comment-id/2218#M2218>

The main points:

* separate your "SSO group" from "Application access group" (in Azure AD case this then leads to the need to have 2 apps installed in Azure AD)
* email is the Unique Identifier, not AD UPN, nor username
* matching in User Provisioning should be done by objectID, since everything else may change over the lifetime of the user. This is NOT highlighted in Atlassian's documentation at all.
* "Continue with Microsoft" functionality is kinda unmanageable, the best you can do is assign the same "SSO group" as you use with SAML application in Azure AD


Tags: cloud

jira-service-management

jira-service-management-cloud