Secure Atlassian Cloud by combining three separate controls: use SAML single sign-on (SSO) to centralize authentication, SCIM to automate account lifecycle changes, and your identity provider’s Conditional Access policies to evaluate sign-in context. Configure and test each in stages, and keep a recovery path for administrators before enforcing changes.
What SSO, SCIM, and Conditional Access each do
- SAML SSO authenticates users. For accounts in verified domains, Atlassian Cloud can redirect sign-in to your identity provider (IdP). Configuring SAML is not the same as enforcing it: enforcement happens through an Atlassian authentication policy. SSO alone does not deactivate accounts when someone leaves your organization. See Atlassian’s SAML setup guide and authentication policy settings.
- SCIM manages accounts and supported groups. Atlassian’s SCIM 2.0 provisioning supports creating, updating, and deactivating accounts from an IdP. SCIM provisioning does not itself provide SSO. Atlassian documents group synchronization for Jira app instances and Confluence, but not Bitbucket or Trello. See Atlassian’s provisioning guide.
- Conditional Access evaluates sign-in context. This is an IdP control, not an Atlassian-native setting. In Microsoft Entra, policies can require controls such as MFA or a compliant device, or block access, depending on assignments and conditions. Other IdPs use their own policy models.
Choose the account and sign-in model
| Model | When it fits | Key consideration |
|---|---|---|
| SAML SSO only | You want centralized sign-in and handle account lifecycle changes elsewhere. | Enabling SSO does not add IdP-driven account updates or deactivation. Atlassian outlines connection options. |
| SAML plus SCIM | You need centralized authentication and automated joiner, mover, and leaver changes. | Plan group synchronization, app-access mapping, credential handling, and staged testing. Feature availability depends on your Atlassian setup and plan. |
| SAML with Just-in-Time (JIT) provisioning | You want an account created at a user’s first successful SAML sign-in. | Atlassian’s documented JIT prerequisites include linked domains and SSO enforced on the default authentication policy. Consider SCIM if you do not want that default-policy enforcement. See Atlassian’s JIT guidance. |
| Google Workspace direct integration | Your organization uses Google Workspace for relevant identity functions. | Atlassian documents direct SSO and provisioning in some contexts; verify the exact app and whether group categorization meets your needs. See Atlassian’s organization security guidance. |
| Microsoft Entra integration | Entra is your IdP and you want to manage sign-in policy there. | Evaluate SAML, provisioning needs, policy scope, and any MFA, device, or location requirements. See Microsoft’s Atlassian Cloud SSO tutorial. |
Check prerequisites and protect administrator access
Atlassian’s documented SAML and SCIM flows require Atlassian Guard Standard, an organization administrator, an IdP directory, and verified domains; SAML setup also calls for linked domains. The SCIM instructions additionally require administration of at least one Jira or Confluence site so synchronized users can be granted app access. Confirm that your current plan and tenant meet the requirements in Atlassian Administration and the relevant Atlassian Guard documentation before you begin.
As an Amazon Associate I earn from qualifying purchases.
- For SAML, ensure the IdP and Atlassian communicate over HTTPS, and synchronize the IdP server clock with NTP because SAML requests have limited validity.
- Allow time to configure and test SAML before enforcing it. Start with a test authentication policy and a test user.
- Keep a working administrator recovery route. Users included in an enforced SSO policy who cannot authenticate through its IdP may be unable to sign in; account for users who should not be forced through that provider.
If the organization needs multiple identity providers, Atlassian’s connection guidance says that requires an Enterprise plan. Check the current plan and topology requirements for your tenant in Atlassian’s identity-provider connection options.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Roll out SAML SSO to a test group first
- Configure SAML with your IdP. Follow the current Atlassian and IdP instructions for the selected provider, then save the SAML configuration. For Entra, use the Microsoft Atlassian Cloud SSO tutorial.
- Enforce SSO through a limited authentication policy. Assign the test policy to a small group whose accounts are ready to authenticate through the IdP. Configuration alone does not enforce SSO for users; Atlassian uses authentication policies for that step.
- Test sign-in and resolve failures. Verify that the test user completes the IdP sign-in and returns to Atlassian successfully. Address configuration or clock-related errors before expanding the policy.
- Expand enforcement deliberately. Add the intended user groups only after the test succeeds, and ensure people who should not use that IdP are not caught by the enforced policy.
Set up SCIM and validate provisioning before broad sync
- Configure provisioning in the IdP directory. Use Atlassian’s current SCIM provisioning instructions for your provider.
- Store the SCIM base URL and API key securely. Atlassian says these values are not shown again after setup. Record the key’s expiry and plan its renewal.
- Start with test accounts and groups. Check that account creation, attribute updates, deactivation, and supported group memberships behave as intended before enabling synchronization for the full population.
- Map synchronized users or groups to Atlassian app access. Provisioning an account does not automatically grant access to Jira or Confluence. Assign the required app access in Atlassian, and verify that your intended groups are within the documented synchronization scope.
Atlassian says SCIM API keys newly set up or regenerated beginning in early January 2025 receive a one-year expiry; the change did not apply retroactively to existing keys. Check the current provisioning page and your key’s displayed expiry rather than assuming an older key follows the same schedule.
#1 Best Overall
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
Apply Conditional Access in the identity provider
For Microsoft Entra, configure the Atlassian Cloud enterprise application and target the intended users and application with Conditional Access policies. Define the policy’s assignments and conditions, then choose the access controls that match your requirements, such as requiring MFA, requiring a compliant device, or blocking access. Microsoft notes that multiple applicable policies may affect the same user and that all applicable policies must be satisfied. Its guidance is in Build Conditional Access policies in Microsoft Entra.
- Scope the policy deliberately. Confirm which users and Atlassian application are covered, and consider how conditions such as location or device state affect legitimate sign-ins.
- Validate before enforcing. Microsoft recommends using report-only mode to assess policy effects before turning enforcement on.
- Preserve emergency access. Microsoft recommends excluding emergency-access accounts from device-compliance policies. Review the applicable device compliance policy guidance.
- Coordinate the rollout. Test the IdP policy alongside the limited Atlassian SSO policy so a Conditional Access block or unmet device requirement does not unexpectedly cut off the test group or administrators.
These policy examples are specific to Microsoft Entra. If you use another IdP, use that provider’s official conditional-access or equivalent policy documentation instead of applying Entra settings by analogy.
Quick Recap
Best Value
Rank #4
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11"
- Reorder SKU: LOG-100-7CW-PP(Watch-Log)
Rank #2
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- This BookFactory log book is for security guards in any sector or business. You can report location, circumstances and report number.
- There are spaces to log the individual's names address, description and other identifying information. There are also spaces to note others involved, notes, and vehicle information if one was involved
- Wire-O, 100 Pages, Dimensions 3.5" x 5.25"
- Reorder SKU: LOG-100-M3CW-PP(Security-Report)
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
