SAML Single Sign On Setup Guides for SAML SSO Current: Azure AD Azure AD Below, you find information to setup Azure AD and our SAML SSO apps for Atlassian Data Center and Server products. If you our need help or have questions, you can contact us via our helpdesk or book a free screen share session at https://resolution.de/go/calendly.If you do not know if you should go with SAML2 or OpenID Connect, please see SAML2 vs. OpenID Connect. Based on your user provisioning model, pick one of the following step-by-step guides.In most cases we recommend to use Azure AD with User Sync.Step-by-Step Guides for SAML2Azure AD with User SyncSetting up User synchronisation with Azure AD, as well as authentication via SAMLAzure AD with Just-in-Time ProvisioningSetting up authentication via SAML with Azure AD and using Just-in-Time Provisioning to create/update User Accounts during login.Azure AD with Manual ProvisioningSetting up authentication via SAML with Azure AD for Users that already exist in the Atlassian product.Step-by-Step Guides for OpenID ConnectAzure AD with User SyncSetting up User synchronisation with Azure AD, as well as authentication via SAMLAzure AD with Just-in-Time ProvisioningSetting up authentication via SAML with Azure AD and using Just-in-Time Provisioning to create/update User Accounts during login.Azure AD with Manual ProvisioningSetting up authentication via SAML with Azure AD for Users that already exist in the Atlassian product.Some important notes:Which Step-by-Step Guide should you pick?Depending on your Atlassian Data Center or Server product, you can choose from different user provisioning models. We recommend using User Sync, since it is easy to setup and maintain. In general, with Azure AD we support the following ways for user provisioning:User Sync allows to sync users periodically from Azure AD, but also when they log in for the first time into your Atlassian product. See our detailed article for User Sync.Just in Time Provisioning allows to create and update users on-the-fly when they log in. A drawback for syncing groups from Azure is, that only group ids and no group names are sent. See our detailed article for JIT.LDAP synchronisation from Active Directory. Is you instance still synchronised to your Active Directory via LDAP, you can continue to do so. Please follow the "Manual User Management" Guide in this scenario.For Manual User Management, the administrator has to has to create and update users on Azure and your Atlassian Data Center or Server product by hand. We do not recommend it. See our article for Manual User Management.Model/FunctionAdmin EffortPro's and Con'sUser SyncLowUses Azure API to perform regular syncUsers and Groups created & updated shortly after done in Azure ADUsers can be disabledAdditional attributes can be written to Jira User PropertiesJust in Time ProvisioningLow, if no groupsHigh, with Groups from Azure(Needs setting it up group transformation rules).Creates & Updates users based on information in the SAML Response during LoginUsers are only created on their first Login.Users & Groups are updated only during SAML authentication.Users cannot be marked disabled (as Azure will not complete the Authentication for a deleted/disabled User)Azure AD only sends group IDs in SAML messages, not friendly names. This requires the setup of Group Transformation rules or acceptance of cryptic Group names in the Atlassian Application.Manual User ManagementHigh Here no sync happensNeeds manual maintenance of 2 User bases (or is done via custom developments). SAML Single Sign-On is available for Atlassian Server & Atlassian Data Center products. Our Jira Data Center, Confluence Data Center, Bitbucket Data Center, Jira Server, Confluence Server, Bitbucket Server and other apps are all available on the Atlassian Marketplace.