Key Challenges & Context: Why Enterprise SSO in Atlassian On-Premise Is Never Straightforward
Our client operates one of France’s most-used consumer apps, serving millions of users daily in the transportation sector. Their engineering and operations teams rely heavily on Atlassian tools (Jira Software, Jira Service Management, and Confluence) to manage development workflows, service requests, and internal documentation.
But identity management had grown organically over the years. No Single Sign-On. No centralized user provisioning. Multiple sources of truth for who should have access to what. They needed to unify authentication across their entire Atlassian on-premise environment by integrating with their Microsoft Entra ID tenant.
This was not a straightforward SSO implementation for several reasons:
- Identity fragmentation: The existing user base included internal employees, external partners, contractors, and service/generic accounts. Each category had different lifecycle rules, permission needs, and identity sources.
- Dual directory synchronization: The identity landscape involved both Microsoft Entra ID and on-premise Active Directory, with synchronization dependencies between the two. Mapping which source of truth should govern which user population required careful architectural decisions.
- Scale of communication: Thousands of users across multiple departments and partner organizations needed to be informed, onboarded to the new authentication flow, and supported through the transition without disruption.
- Permission inheritance: Granting and revoking permissions at scale, across three Atlassian products with different permission models, required a governance framework that didn’t previously exist.
The Approach: Parallel Workstreams Over 8 Months
We structured the project across five workstreams running in parallel:
1. Discovery and mapping: We inventoried all tooling, user types, connected apps, and organizational boundaries to produce a complete picture of who was using what, how they were authenticated, and what would break if we changed it.
2. Architecture design: Working directly with both Microsoft and Atlassian, we designed an identity architecture tailored to handle the multi-directory, multi-population reality, not a default template deployment.
3. Data cleanup and preparation: Before implementation, we cleaned years of accumulated identity debt: duplicate accounts, orphaned users, inconsistent naming conventions, and generic accounts that needed reclassification or decommissioning.
4. Cross-functional team coordination: We assembled a team combining technical contacts (directory sync, user provisioning, SSO configuration) with business contacts (user communication, test coordination, process change documentation). Neither side alone could have delivered this.
5. Change management and rollout: Implementation was paired with structured UAT cycles, progressive rollout across user populations, updated documentation, and direct support channels.
Benefits: Unified Identity, Centralized Governance, and Security Compliance
After 8 months, the client’s Atlassian environment operates under a unified identity model:
- Seamless login across Jira Software, Jira Service Management, and Confluence via SSO. Users authenticate once through their organization’s standard login flow.
- Centralized permission management. User access is now governed by group memberships in Entra ID, propagated automatically across all three Atlassian products. Onboarding and offboarding happen in one place.
- Security compliance. The implementation follows industry standards for enterprise authentication, eliminating the risks of local-only accounts, shared credentials, and unaudited access.
Key Takeaway
Identity unification in Atlassian on-premise environments is rarely just a technical exercise. When the user base spans internal teams, external partners, and automated service accounts across multiple directories, the real challenge is governance: deciding who should be the source of truth for each population, how permissions cascade, and how you transition thousands of users without breaking their workflows.
