Atlassian Cloud SSO (Single Sign-On) using Entra ID (Azure AD) as OAuth Provider

Atlassian Cloud OAuth Single Sign-On (SSO) with Entra ID

With Jira OAuth Single Sign-On (SSO) for Atlassian Cloud, you can securely log in to Atlassian Cloud using your Azure AD/Entra ID credentials. This app allows you to perform seamless Single Sign-On (SSO) into your Atlassian Cloud accounts using your existing Azure AD credentials.

    Try it for free

Pre-requisites

  1. Atlassian Guard (Atlassian Access) Subscription:
    Atlassian Guard is an additional subscription applied across the Atlassian Cloud products, like Jira Software, Jira Service Management, Jira Work Management, Confluence, and Bitbucket. It is needed for Single Sign-On (SSO) or any Cloud Service across Atlassian Cloud products.
  2. Domain Verification:
    Atlassian Guard requires the Domain Verification process to enforce SSO on the managed user accounts. This process verifies that you own a valid domain for managing the user accounts and use the same domain name for the email addresses.

Download and Installation

  • Log in to your Atlassian Admin Console and select your site.
  • Now in the sidebar, find the site section and click on it to access Site Settings.
  • In the Site Settings, navigate to Connected Apps → Explore apps. (Alternatively, you can go to the Atlassian Marketplace and search for the app.)
  • Search for miniOrange OAuth/OpenID SSO.
  • Click “Try it free” to begin a new trial of the app.
  • On the top menu bar, go to Apps.
  • Locate the “mO Jira OAuth/OpenID SSO” app and click to open it.

In this guide, we will demonstrate the setup in three parts:

  1. Configure OAuth SSO connection between miniOrange App (as OAuth Client) and Azure-AD (as OAuth Provider).
  2. Configure SAML SSO connection between Atlassian Guard (as SP) and miniOrange App (as IDP).
  3. Add users to the SSO Authentication policy, and enforce the SSO.

Step 1. Configure SSO connection between miniOrange App with Azure-AD

  • Once the plugin is installed, select the Apps section from the sidebar menu and click on mO Jira OAuth/OIDC SSO option.
    • Jira app main menu with the Apps section open and the mO Jira OAuth/OIDC SSO app highlighted
  • Next, you will be prompted with a welcome pop-up window. Click Start Configuration.
    • Welcome window of mO Jira OAuth/OIDC SSO app.
  • Now, in the Configured Providers section, click the "Add Provider" button.
    • Configured providers section in the mO Jira OAuth/OIDC SSO app
  • Select Azure-AD as the application.
  • And copy the callback URL from the OAuth / OIDC Provider Configurations page and keep it handy, as you'll need it to configure Azure-AD as the OAuth provider.
    • OAuth / OIDC Provider Configurations tab in the mO Jira OAuth/OIDC SSO app
  • Now, log in to Azure AD Portal.
  • Select Microsoft Entra ID.
    • Microsoft Entra ID dashboard with Microsoft Entra ID option highlighted
  • Select Enterprise applications, click on Add, and select App Registration.
    • Default directory with Enterprise applications section highlighted
  • Enter the name for the application and under Redirect URL, select web and enter the copied Callback URL.
    • Register an application page in the Azure AD portal
  • Now, copy the Client ID. Generate a new secret and copy it as well.
  • For endpoints, you can refer the endpoints tab here , or you can visit azure well known OAuth endpoint :
    https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration
    • Endpoints tab in the Microsoft Entra ID portal
  • Next, return to the miniOrange App configuration page. (OAuth / OIDC Provider Configurations )
  • Enter Client ID, Client Secret, Scopes (like User.Read, Directory.Read.all), and other required endpoints. Once done, click Save Configuration.
    • mO Jira OAuth/OIDC SSO app configuration page where Client ID, Client Secret, Scopes, and other required endpoints can be entered

Step 2. Set up SSO between Atlassian Guard and miniOrange App

After saving the OAuth Configuration, you’ll be required to configure Atlassian Guard and the miniOrange OAuth/OIDC SSO App.

  • A pop-up notification will appear, asking you to complete the Atlassian Guard configuration.
    • Pop-up notification asking to complete the Atlassian Guard configuration
  • Click on Configure Guard, and you will be navigated to the Guard Configurations section.
  • In this section, you will find the Plugin Metadata details.
  • Copy and keep the following values handy. You’ll need them while setting up your Identity Provider in Atlassian Guard:
    • IDP Entity ID
    • IDP SSO URL
    • IDP Public X.509 Certificate
      • Atlassian Guard configurations page where Plugin Metadata details can be found
    1. Open the Atlassian Admin Console and navigate to the Security tab.
      2. Note: In case you manage multiple organizations, you’ll have to select the intended one after accessing the admin console.
    2. Under User Security, click Identity Providers.
    3. Select Other to begin configuring a custom Identity Provider.
      4. Atlassian Guard security page where Identity Providers section can be found
  • Provide an appropriate name, select Set up SAML Single Sign-On, and click Next.
  • Now, paste the IDP Entity ID, IDP SSO URL, and Public X.509 Certificate that you copied from the plugin configuration.
    • Atlassian Guard configurations page where IDP Entity ID, IDP SSO URL, and Public X.509 Certificate can be pasted
  • Click Next and copy the Service Provider Entity ID and Service Provider Assertion Consumer Service URL. Keep these handy as they’re required to complete the plugin configuration.
  • Complete the rest of the Atlassian Guard configuration.
  • Once you’re done, return to the plugin, go to the SP Metadata tab in the Guard Configurations section, and click Next.
  • Enter the SP Entity ID and Assertion Consumer Service (ACS) URL that you copied, and click Save Settings.
    • Atlassian Guard configurations page where SP Metadata tab can be found

Step 3: Configure SSO Authentication Policy

Once all the SSO Configurations are done, you need to add users to the Authentication Policy and enforce Single Sign On.

After saving the SP Metadata, click Next to find the steps for adding the users to the Authentication policy.

Atlassian Guard configurations page where Authentication Policy tab can be found

Now you can now seamlessly enjoy Single-Sign On into Atlassian with your preferred OAuth provider, with our miniOrange app.

OAuth Saml App

Did this page help you?

miniOrange Atlassian Contact Us

Book a Free Consultation with
Our Experts Today!

Schedule a call now!


Contact Us