Azure MFA with Atlassian SSO built-in app

[Slaven Radovic]

Hello, we are using both Jira and Confluence server, and we manage users centrally in Microsoft AD that's linked to Jira and Confluence via LDAP. 

We're planning to migrate to DC, and we're also interested in implementing MFA via Azure AD.

Is that possible with the Atlassian's built-in SSO app? 

If it is, is it possible to continue to use Microsoft AD/LDAP for user sync, since Atlassian's app doesn't offer that functionality?

If these two are possible, is there any other drawback that makes more sense to use third party apps?

Thanks,

Slaven

[Lokesh Naktode_miniOrange]

Hi Slaven,

I think you are just planning to delegate "User authentication + MFA" to Azure AD but Microsoft  AD/LDAP will be still connected directly with JIRA and Confluence for Sync then yes, you can go ahead with built-in SSO without any issue.

This is Lokesh here and I work for miniOrange, one of the top SSO App developers for Atlassian Application.

From my experience, there is one problem that built-in SSO won't be able to handle that is "Signing key rollover". Here, keys roll over on a periodic basis and, in an emergency, could be rolled over immediately. All applications that use the Microsoft identity platform should be able to programmatically handle the key rollover process.

Reference:

https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-signing-key-rollover

In this case, once the signing certificate is changed, SSO will not work. You have to manually update the certificate every time.

If you are interested, you can give a try miniOrange SSO. It has the capability to auto fetch updated certificates and provide advanced security like sign requests, encryption, usability, and provisioning features.

Feel free to reach out to miniOrange in case of any question or need assistance with plugin setup.

Thanks,

Lokesh