A step-by-step guide for integrating Azure Active Directory (Microsoft Entra ID) with Atlassian Cloud products (Jira, Confluence) for SAML SSO and SCIM provisioning.
This guide provides detailed, step-by-step instructions for integrating Azure Active Directory (Microsoft Entra ID) with Atlassian Cloud products (Jira Software, Confluence) to configure SAML Single Sign-On (SSO) and SCIM-based user provisioning.
Goal: To centralize user identity management in Azure AD, enabling seamless and secure login (SSO) and automatic user provisioning/de-provisioning in Atlassian Cloud.
| Component | Requirement |
|---|---|
| Azure AD Tenant | Global Administrator or Privileged Role Administrator account. |
| Atlassian Cloud | Organization Administrator account for your Atlassian site (e.g., myteam.atlassian.net). |
| Atlassian Access | This feature must be enabled on your Atlassian account. It is required for SSO and SCIM. |
| Licenses | Azure AD Premium P1 or P2 licenses are required for SCIM provisioning. |
- Sign in to the Azure Portal as a Global Administrator.
- Navigate to Azure Active Directory > Enterprise applications.
- Click New application > Browse gallery.
- Search for "Atlassian Cloud" and select it.
- Enter a name for the application (e.g.,
Atlassian Cloud Production) and click Create.
- In your new Enterprise Application, go to the Single sign-on section and select SAML.
- Click the edit (pencil) icon for Basic SAML Configuration.
- Enter the following identifiers and URLs:
- Identifier (Entity ID):
https://auth.atlassian.com/saml/<your-atlassian-org-id>How to find your Org ID? In your Atlassian admin console, go to Security > Identity providers. Your organization ID is displayed at the top.
- Reply URL (Assertion Consumer Service URL):
https://auth.atlassian.com/login/callback - Sign on URL:
https://auth.atlassian.com/login/callback?connection=saml-<your-atlassian-org-id>
- Identifier (Entity ID):
- Click Save.
-
In the SAML-based Sign-on section, click the edit icon for Attributes & Claims.
-
Ensure the following claims are present. If not, add them:
Name Value Namespace http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifieruser.mail- http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressuser.mail- http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameuser.displayname-
- In a new tab, sign in to your Atlassian Organization Admin portal.
- Go to Security > Identity providers > Add SAML connection.
- Give the connection a name (e.g., "Azure AD SSO").
- Return to the Azure AD tab. Download the Federation Metadata XML from the SAML Signing Certificate section.
- Back in the Atlassian tab, upload the downloaded XML file.
- Click Continue and then Finish.
- In your Atlassian Organization Admin portal, go to Security > User provisioning.
- Click Generate API token. Copy this token immediately—you will not be able to see it again.
- Back in your Azure AD Enterprise Application, go to the Provisioning section.
- Set Provisioning Mode to Automatic.
- In the Admin Credentials section:
- Tenant URL:
https://api.atlassian.com/scim/directory/<your-atlassian-org-id> - Secret Token: Paste the API token you generated in Atlassian.
- Click Test Connection to ensure it succeeds.
- Tenant URL:
- Click Save.
- In the Provisioning section, click Mappings.
- Review the default mappings. The most critical ones are:
- userName -> userName (Maps to
emails[type eq "work"].value) - active -> active
- emails[type eq "work"].value -> emails[type eq "work"].value
- displayName -> displayName
- userName -> userName (Maps to
- (Optional) To sync groups, edit the Provision Azure Active Directory Groups mapping and ensure the necessary group attributes are mapped.
- In the Provisioning section, set Provisioning Status to On.
- Set the Scope to sync only assigned users and groups or all users.
- Click Save. The service will start an initial sync, which may take some time.
- Go to your application's overview page in Azure AD and click Assign users and groups.
- Assign a test user to the application.
- Use the ** assigned test user** to navigate to your Jira or Confluence site URL.
- You should be redirected to the Microsoft login page and, after authentication, seamlessly logged into Atlassian.
- Assign a new user or group in Azure AD.
- Wait ~20-40 minutes for the provisioning cycle to run, or manually trigger it by going to the Provisioning blade and clicking Provision on demand.
- Verify the user appears in your Atlassian admin directory with the correct attributes.
- "User not provisioned": Check the Provisioning Logs in Azure AD for detailed error messages. Common causes are duplicate emails or missing required attributes in Azure AD.
- SSO Login Fails: Use the browser's developer tools (F12 -> Network tab) to capture the SAML request/response. Verify the NameID and other claims match the expected format in Atlassian.
- "Invalid credentials" when testing connection: Regenerate the API token in Atlassian and update it in Azure AD.
This guide is provided for educational and reference purposes. Always test configurations in a non-production environment first. Procedures and UI may change over time.