Goal

After completing this setup guide, you will have set up Microsoft Entra ID (formerly Azure AD) with Just-in-Time Provisioning and your Atlassian product for the SAML SSO for Atlassian Server or Data Center app. Additionally, you will enable the SSO redirection and test SSO.

Prerequisites

To use the SAML SSO app for Atlassian Server or Data Center with Microsoft Entra ID (formerly Azure AD), you need the following:

• An Microsoft Entra ID (formerly Azure AD) subscription

• A (trial) subscription for the SAML SSO app

• Admin access to your Atlassian product
  
  

Step-by-Step Setup Guide

Install the SAML SSO App

In your Atlassian product, open the in-product marketplace as described in the Atlassian documentation.
Search for "resolution saml" and click "Install" for SAML Single Sign On (SSO) by resolution Reichert Network Solutions GmbH.


After the installation is complete, click Manage Apps/Addons. 

Configure SAML SSO

For the next steps, please go to Manage apps (or addons), choose SAML SSO and click Configure.

First Steps - Wizard

After you clicked "Configure", the Wizard will be triggered. If not, or if you want to add another Identity Prover (IdP) to your existing configuration, click on "+ Add IdP". This guide assumes, that there is no IdP configured.
The Wizard greets you with information, click on "Add new IdP" to proceed.

welcome_wizard_add_newidp

Select Azure AD for your identity provider and select OpenID Connect for the authentication protocol. Enter a unique name and click Next to continue. 

Copy the callback url to your favourite text editor. 

Next, go to https://portal.azure.com. 

Then, click App registrations and click New registration.

Enter an app name and the copied oidc callback url into the Redirect URI. 

After the creation of the app, copy the Application (client) ID and the Directory (tennant) ID into a texteditor of your choice.



Next, go to Certificates & secrets and click New client secret.

Set the expiry to your needs (we recommend 24 months) and click Add.

Copy the secret value (but not the id) to your editor.


Next, go to Token configuration and click Add optional claim.


For the Token type, use ID. For the claim select UPN. Click Add.

If Azure asks for the Microsoft Graph profile permission, please do so. 

If you have guest users in Azure AD who would also use SSO, then you would need to do the following:

Click on "..." for the upn claim, and click on Edit.

Then enable the Externally authenticated option, and click on Save.

Now, go back to your Atlassian application to finish the wizard. 

Enter the Client ID and Client Secret from before.

Next, enter the Azure tennant ID from before and click the Import Metadata button.

You will see this message if the import was successful.

To finish the wizard, click Save and Close.

To Configure Just-In-Time provisioning, go to UserSync.

Click Create Connector and choose Just-In-Time.

On the next screen, you must either select an existing directory or click the Create new empty directory... button.

Next, go to the Provisioning Settings. In order for our app to create new users, you must map the Username, Full Name and Email. Additionally, you may also want to assign users automatically on creation to groups. You can use Always Assign Users to Certain Groups for this.

For Microsoft Entra ID (formerly Azure AD), you need the following mappings. For this tutorial, we show how to map the username as an example.

Click Map on the Username row and enter upn as the attribute. If you need to transform the value, you can do this here. Click Apply to finish.

After mapping all necessary attributes, your view should look like this:

Click Save and Return to finish the configuration.

Next, we need to assign this connector in the OpenID Connect configuration. Go back to the SAML SSO configuration.

Scroll down to the User Creation and Update section. Choose Update with UserSync for the User Update Method.

Now, select the Just-In-Time connector that was created before and click Save to finish the configuration.

Testing SSO