
## Why is Data Encryption Important in Atlassian Apps? {#why-data-encryption}

Data encryption is a way to **protect your business data from unauthorized users** even if they get access to your apps. Atlassian apps like Jira and Confluence store sensitive information like financial data, intellectual property, and customer details. 

&nbsp;

By implementing Atlassian data encryption, all data sent to and from Atlassian apps gets encrypted, ensuring that it remains safe both in transit (moving between devices & servers) and at rest (stored on servers). Even if an unauthorized user manages to intercept your data, it will remain unreadable due to the encryption layer.

## How Does Atlassian Data Encryption Work? {#how-it-works}

When you use Atlassian apps like Jira Cloud and Confluence, your data undergoes a seamless encryption and decryption process. Here’s how it works:

&nbsp;

- **The User Interacts with the App:** The user opens the Jira Cloud instance and initiates an action, like accessing a ticket or uploading a document.

&nbsp;

- **Request Goes to CASB:** The request to access the data is transited through the Jira app to the Atlassian Cloud Access Security Broker (CASB).

&nbsp;

- **Data Encrypted by Atlassian CASB:** The CASB acts as a security checkpoint and encrypts the data before sending it to the Atlassian Cloud server for rest.

&nbsp;

- **Requesting Data from Atlassian Cloud:** When the user requests data from a ticket, the data is retrieved from Atlassian Cloud in encrypted form, ensuring its confidentiality during transmission.

&nbsp;

- **Decryption by CASB:** Once the Atlassian CASB receives the encrypted data, it utilizes its decryption capabilities to unlock the information.

&nbsp;

- **Decrypted Data Sent to Jira and the User:** Finally, the CASB delivers the decrypted data securely to your Jira application, allowing you to see the information you requested.

![Atlassian data encryption](/blog/assets/2024/data-encryption-casb.webp)



##  miniOrange: Atlassian Data Encryption {#mo-data-encryption}

[miniOrange](https://www.miniorange.in/) offers the best data encryption solution that prioritizes data security on Atlassian apps like Jira and Confluence. With robust encryption measures and a suite of advanced security features, our data encryption solution provides the utmost security for business data on these apps. 

&nbsp;

***Looking for Jira security solutions? Check out our blogs on [miniOrange Jira Cloud Security](https://www.miniorange.in/blog/tag/Jira/).*** 

## Our Advanced Security Features for Atlassian {#features}

miniOrange [CASB solutions](https://www.miniorange.in/casb/solutions/) also provide other Atlassian security features to protect your business data. Here are its features:

### 1. Bring Your Own Key (BYOK) 

SOC admins can configure Atlassian data encryption by bringing their keys and regularly rotating these encryption keys to ensure maximum security.

### 2. Threat Mitigation

Our Atlassian security solutions let you continuously monitor and get alerts for unauthorized data access attempts, enabling SOC teams to take swift action against internal attacks by revoking user access.

### 3. Analytics and Reporting 

Gives detailed reports and analysis of user activity, helping SOC teams understand security threats and reduce system downtime.

### 4. User Risk Score Assessment

Assign risk scores to users based on their activity with Atlassian Cloud apps. This allows for proactive security measures, including strong restrictions and access revocation when thresholds are exceeded.

### 5. DLP Integration

Prevents unauthorized data downloads and mitigates threats like sensitive data exploitation in Jira and Confluence, ensuring robust protection against data breaches.

### 6. Malware & Ransomware Protection

Detects and isolates malware or ransomware attacks instantly to contain and resolve threats effectively, protecting your organization from significant damage.

&nbsp;

**Don't leave your data vulnerable to Atlassian apps.**

&nbsp;

Implement [miniOrange Atlassian security integration](https://www.miniorange.in/casb/integrations/atlassian-apps) and experience peace of mind knowing that your information is protected by one of the industry's most trusted names.  

&nbsp;

Contact us at [info@xecurify.com](mailto:info@xecurify.com) to enquire and learn more about the Atlassian data encryption solution.

### Additional Resources {#reference-links}

1. [Google CASB](https://www.miniorange.in/casb/integrations/google-workspace)
2. [Remote Work Security](https://www.miniorange.in/casb/solutions/remote-work-security)
3. [Hybrid Work Security](https://www.miniorange.in/casb/solutions/hybrid-work-security)
4. [Corporate/Office Network Security](https://www.miniorange.in/casb/solutions/office-network-security)


Many businesses rely on Atlassian collaboration tools like Jira Cloud and Confluence to manage sensitive data, such as confidential financial records, intellectual property, and employee data. However, data breaches can occur due to unauthorized access or malware, leading to significant financial losses, reputational damage, and legal repercussions. 
Data encryption in transit or at rest is a powerful solution offered by Atlassian CASB to solve these concerns. By encryption data in transit and at rest, businesses can significantly reduce the risk of a breach and ensure the security of their critical information. 

 How to secure your Jira & Confluence data with Atlassian Data Encryption?


## Atlassian CASB: Compliance, Granular Access Control, and Visibility

Atlassian is a leading software company known for its tools that enhance team collaboration, productivity, project organization, and workflow management. Widely used for agile project management, the Atlassian Suite helps numerous companies streamline their project lifecycles and track progress effectively, no matter the project size or team resources.

&nbsp;

However, it's important for companies to follow certain rules and guidelines to protect their data when using apps like Jira and Confluence. For instance, companies may need to prevent data export from Jira Cloud, trace attachment downloads from Jira and Confluence, or block downloads based on a network IP address to ensure data security. If they don't comply with standards like GDPR and HIPAA, or their internal policies, it can risk the security and reliability of their data on these apps. Ensuring Jira and Confluence compliance helps organizations protect their data, maintain trust with stakeholders, and ensure that Atlassian tools work reliably.

&nbsp;

miniOrange [Atlassian CASB integration](https://www.miniorange.in/casb/integrations/atlassian-apps) with Jira and Confluence helps companies meet industry compliance standards. It provides clear visibility and strict control over how users interact with these apps. This integration allows security teams to closely monitor user activities, block downloads from Jira, Jira Service Management, and Confluence SaaS from users on external networks, and ensure everything runs smoothly. 

&nbsp;

Let’s take a closer look at Atlassian CASB security and how it benefits organizations.

## What are Atlassian apps? {#what-are-atlassian-apps}

Atlassian apps, also known as Atlassian Marketplace apps, are software extensions that can be added to Atlassian's core products, such as Jira and Confluence. 

&nbsp;

- **Jira:** It helps teams manage workflows, submit issues, track tickets, automate tasks, and monitor project progress. It follows agile methodology principles and is widely used by companies to boost productivity and project growth. For enhanced security, features such as blocking downloads from Jira, Jira Service Management, and Confluence SaaS from users on external networks can be implemented.

&nbsp;

- **Confluence:** It creates a shared workspace where teams can collaborate on projects. It provides transparency and workflow management and allows users to see each other's contributions and the project's progress over time. 

&nbsp;

Using tools to trace attachment downloads from Jira and Confluence can ensure secure management of project documents.

## List of Atlassian Apps {#list-of-atlassian-apps}

Here’s a breakdown of the different apps used with Jira and Confluence, along with simple explanations for each:

### Jira Service Desk
Jira Service Desk is a platform to receive issues from customers and track customer lifecycles from querying to deploying the solution with all the paperwork and request queuing.

### Jira Core 
Jira Core is a highly organized workflow project, where all teams can create a step-by-step process to complete tasks on time. They are highly versatile and can be used by all departments within an organization.

### Jira Software
Jira software utilizes the power of Kanban and Agile methodologies, to build project sprints, list issues, create backlog items, task completion and velocity, and visually depict the team’s progress.

### Bitbucket 
Bitbucket is an on-premise Git repository management software for all team members to collaborate on projects and is the top competitor for the Microsoft-owned GitHub.

### Confluence
Confluence is a document collaboration tool for teams to keep records of a research topic or share steps to configure a standard software tool to promote transparency within the team.

### Statuspage
Statuspage lets the customers know about scheduled downtime for maintenance of the application to prevent sudden crashes. It stands as an “Incident Management Messenger” between you and your end users.

### Opsgenie
Opsgenie helps your developer teams and operations teams stay on top of threat alerts and incidents and control the situation in real-time.

### Jira Align 
Jira Align enables project planning and strategy alignment with support for hundreds of users at different levels in the organization.

![Four pillars of Atlassian CASB Security for data download prevention](/blog/assets/2023/casb-atlassian-solution-blog.webp)

## Why is Atlassian App Security Important? {#why-casb-secures-atlassian-apps}

Atlassian App Security is crucial for keeping your project data safe and ensuring smooth team collaboration. Recently, Atlassian announced the [end of sale and support for Atlassian server apps](https://developer.atlassian.com/platform/marketplace/knowledge-base/end-of-sale-and-support-for-server-apps/), leaving Data Center (DC) and Atlassian Cloud as the main options.

&nbsp;

Data centers are an expensive option and most users cannot switch to DC, hence, they have no choice but to move to Atlassian Cloud. However, using the cloud has its set of disadvantages. The most important one is the **lack of data security compliance** with regulations like ITAR, FERPA, and HIPAA and potential **threats of security breaches**, leading to a lack of trust in Jira Cloud and Confluence compliance security.

&nbsp;

To address these risks, miniOrange offers [Cloud Access Security Broker](https://www.miniorange.in/casb/) (CASB) for Jira and Confluence. Our [CASB solutions](https://www.miniorange.in/casb/solutions/) can prevent data export from Jira Cloud, trace attachment downloads from Jira and Confluence, and block downloads based on IP addresses, allowing access only within the corporate network. Without CASB for Jira and Confluence, there's a heightened risk of data leaks and security threats where sensitive information could be exposed to unauthorized parties.

&nbsp;

Implementing a CASB solution ensures that your Atlassian Cloud apps remain secure and compliant with regulations. It helps you detect and respond to potential security incidents, safeguard your organization's data, and maintain trust in your project management tools. Specifically, Atlassian CASB solutions can block downloads from Jira, Jira Service Management, and Confluence SaaS for users on external networks, further enhancing security.

&nbsp;

In summary, Atlassian App Security, particularly through Atlassian CASB solutions, is essential for protecting your data and ensuring the reliability of Atlassian Cloud apps like Jira and Confluence. This proactive approach helps mitigate risks and keeps your projects running smoothly and securely.

## How does CASB protect your Atlassian apps? {#casb-protect-atlassian-apps}

Here’s how a Cloud Access Security Broker (based on the [4 fundamental pillars](https://www.miniorange.in/blog/what-are-the-4-pillars-of-casb/)) secures your Atlassian SaaS apps to provide Jira Cloud and Confluence security.

&nbsp;

Imagine a company using the Atlassian Cloud for project management and team collaboration.

&nbsp;

Within this company, there are two groups of users: the support team and the analytics team. Both groups use the Jira Tickets service. The support team accesses customer information stored in the tickets to help customers with their products. Meanwhile, the analytics team exports customer data from Jira Tickets to analyze and gain insights.

&nbsp;

Let’s say there are 2 users, Jeremey from the support team and Noah from the analytics team.

&nbsp;

Jeremy can view customer Jira tickets to see what products they’ve bought and provide support. However, if he tries to export data, the Atlassian CASB solution stops him.

&nbsp;

On the other hand, Noah from the analytics team can export the Jira Tickets data to analyze it further for his team’s insights.

&nbsp;

This way, the miniOrange Atlassian CASB solution will provide role-based access to the different solutions on the Atlassian App suite for Jira and Confluence security. Additionally, you also get deep visibility into the traffic on your Atlassian app usage for the Security Operations Center to gain deeper insights into potential security threats targeted towards their Atlassian apps.

![Role-based access restriction to prevent data export using Atlassian CASB Security](/blog/assets/2023/atlassian-export-data-casb.webp)

## Benefits of Atlassian CASB Security {#benefits-casb-atlassian-security}

Here are the key benefits of using Atlassian CASB security for Jira Cloud and Confluence security.

### Granular Visibility and Control: 
Get insights into the smallest security detail for each of your Atlassian Suite apps, and configure custom access restriction rules to protect company data from unknown third-party entities. You can also prevent data export from Jira Cloud and trace attachment downloads from Jira and Confluence to ensure data remains secure.

### Compliance Inclusion: 
Atlassian CASB solutions ensure your business meets industry security standards like [ITAR](https://www.miniorange.in/blog/itar-compliance-with-casb-for-data-security/), FERPA, and HIPAA by enforcing data protection policies and gathering detailed insights.
 
### DLP Integration: 
[Data Loss Prevention](https://www.miniorange.in/data-loss-prevention-dlp) (DLP) prevents data breaches and defends against various advanced threats like next-gen spam, phishing attack filters, and many more that work with cloud applications, making this a must for Jira Cloud and Confluence security. Additionally, you can block downloads from Jira, Jira Service Management, and Confluence SaaS from users on external networks to further enhance data security.
 
### Analytics and Reports: 
Monitors cloud activity and generates threat reports that help your team discover new observations. This way, you can visualize data to see unusual activity with any Atlassian app and peak downtimes. 

### User Risk Score Assessment: 
Depending on the user activity, a risk score is assigned to each user to flag them based on their activity with the Atlassian apps. Once the score exceeds the safe score limit, the necessary security restrictions configured will kick in to revoke all access permissions and isolate the user from further interacting with any of the Atlassian apps with the help of our Atlassian CASB solution.

## Additional Solutions Incorporation: 
Alongside miniOrange CASB security, you can also check out our other [Atlassian enterprise security products](https://www.miniorange.in/atlassian/) as well. All our solutions can be integrated individually or alongside the miniOrange Atlassian CASB for all-around Jira Cloud and Confluence security features.

## In Conclusion {#summary}

We explored how miniOrange CASB ensures comprehensive security for the Atlassian Suite. It offers you a smooth way to monitor users closely, apply strict compliance rules such as ITAR, FERPA, and HIPAA, and gain detailed insights into potential threats against your company's sensitive data stored on any Atlassian app in the cloud, including Jira Cloud and Confluence.

&nbsp;

If you're in the market for a Cloud Access Security Broker (CASB) solution specifically for securing the Atlassian Suite, miniOrange is highly recommended. It provides robust access control features tailored to meet your company’s needs, effectively reducing risks. miniOrange also offers top-notch global support at competitive prices to cater to all your security requirements.

&nbsp;

Don't hesitate to reach out to us at [info@xecurify.com](mailto:info@xecurify.com) with any questions or inquiries, and we'll respond promptly!

### Additional Resources

Check out more Atlassian App Security products by miniOrange,

-   [Atlassian SSO and User Sync](https://miniorange.in/atlassian/)
-   [Jira SAML SSO](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/xecurifyinc1630054845227.jira_saml_sso_atlassian_final?tab=overview)
-   [2FA/MFA for Jira Apps](https://miniorange.in/atlassian/two-factor-authentication-2fa-for-atlassian-data-center-dc-and-cloud/)
-   [Confluence 2FA/MFA](https://miniorange.in/atlassian/confluence-two-factor-authentication-2fa)
-   [AWS services CASB](https://blog.miniorange.in/aws-service-casb-security-solution/)


Atlassian CASB security helps businesses comply with all the safety standards for Jira and Confluence apps, ensuring their cloud data is protected and in line with Atlassians security and trust measures.

Atlassian CASB Security: Jira & Confluence Compliance


According to the **Atlassian announcement** that came out in October 2020, new server license sales have come to end on 2nd February 2021. Server support for existing licenses will continue to be offered by Atlassian until Feb 2024. However, maintenance and support pricing would increase for server licenses. Atlassian is providing all its server customers three years of time to migrate to the Data Center or Cloud depending on their business needs.

Focusing on the existing server licenses, until 2nd Feb 2022, Atlassian will provide support [database, java, browser] and bug fixes for server products. Beyond that, Atlassian will only provide security bug fixes for critical vulnerabilities until the products will reach the end of support i.e. 2nd Feb 2024. Server customers will also experience an increase in maintenance costs. Also, upgrading and downgrading of user tiers for server products and applications will be limited till 2nd Feb 2022.

&nbsp;&nbsp;  

**Impact on Atlassian Marketplace Add-Ons**

- Existing server customers can still purchase server apps/ add-ons available on Atlassian Marketplace till 2nd Feb 2023. 
- Renewals for atlassian marketplace add-ons will also continue till “2023”. 
- Beyond that, you won’t be able to renew your add on license which implies end of server life in Atlassian.
- If you have a Data Center instance, you will need to purchase a Data Center subscription of the add-on provided, the DC version is available on Marketplace.
- If there is no Data Center version available, you can continue to use the server version of the app, though it comes with some risk as the app has not received an architecture review or been performance tested to ensure it can scale in a Data Center environment.
- Whenever a Data Center version becomes available, you will then need to purchase a Data Center subscription to use it on your Data Center instance.

As a customer centric [Atlassian SSO vendor](https://marketplace.atlassian.com/vendors/1213308/miniorange), we are committed in helping our server customers to migrate to Data Center. We will be providing full support and maintenance for all our Server add-ons till 2024.

&nbsp;&nbsp;  

Reach out to us at **support-atlassian@miniorange.atlassian.net** or raise a support ticket by [clicking here.](https://miniorange.atlassian.net/servicedesk/customer/portal/2)

Atlassian server support is ending in February 2024. Existing customers have three years to migrate to Data Center or Cloud. Server support will be limited after February 2, 2022, with no new bug fixes or features. Marketplace add-on sales and renewals will end on February 2, 2023. miniOrange will be providing migration support for customers.

Atlassian Server is gone but Marketplace Add-ons stays with you!


## Atlassian’s Server License Discontinuation: What are your options? {#atlassian's-server-license-discontinuation}

By now, everyone is aware of Atlassian’s announcement on Server license discontinuation and selling new server license instances from Feb 2, 2021. If you have been living under a rock and missed the announcement, you can check it out here: 

[https://www.atlassian.com/blog/announcements/journey-to-cloud](https://www.atlassian.com/blog/announcements/journey-to-cloud)

&nbsp;&nbsp;


![atlassian-server](/blog/assets/2023/atlassian-server-license-discontinuationtimeline.webp)

&nbsp;&nbsp;

### To whom end of life applies to? {#to-whom-end-of-life-applies-to}
- Jira Software Server
- Jira Core Server
- Jira Service Management Server 
- Confluence Server
- Bitbucket Server
- Crowd Server
- Bamboo Server
- Atlassian-built Server apps

&nbsp;&nbsp;

**10 – 50 Users:**

With this tier, you will find it easier to just go ahead with Cloud Migration, as upgrading to DC will prove to be a big financial overhead. The basic data security has been taken care of by Atlassian and unless you have stringent security compliance needs, moving to Atlassian Cloud will be a perfect solution for you. There is a free license available as well, although with very limited features. For a smooth transition to cloud migration, we at miniOrange will provide seamless support. You can find out more about Single Sign On for Cloud over at [https://www.miniorange.in/atlassian-cloud-single-sign-on-(sso)]

&nbsp;&nbsp;

If you do have security compliance needs, you can check Atlassian cloud’s security and compliance details here: [https://www.atlassian.com/trust](https://www.atlassian.com/trust). If the compliance you’re looking for is not listed, you should stick to Server for now and raise a request with Atlassian support to know whether it’s in their pipeline and make a decision accordingly.

&nbsp;&nbsp;

**Our Recommendation: Atlassian Cloud**

### 100 Users {#100-users}
If your users fall into this category and you foresee a rise in their numbers and have strict compliance criteria, there is no better alternative than Atlassian Data Center. However, if you do not need compliances, you might want to consider cloud migration as it would be a cheaper option.

**Our Recommendation: Atlassian Data Center**

### 250 Users and more {#200-users-and-more}
The Data Center will be the best choice for the tier with more users. As the number of users in the cloud increases, it will become expensive. You could also be using a lot of marketplace applications, which are more likely to be available on Atlassian Data Center rather than cloud, so keep that in mind.

&nbsp;&nbsp;

**Our Recommendation: Atlassian Data Center**


Our suggestion is based on what we believe is best for you, but you are free to think outside the box. Here are a few points to think about when deciding between Cloud and Data Center:

1. What is the user-tier for you? Will it be the same after 1-2 years?
2. Do you want security certifications?
3. What do you have in your budget?
4. Compatibility of Marketplace Apps
5. Storage Requirements
6. Load on applications (using multiple machines to balance the load)

&nbsp;&nbsp;

I hope that this article has helped you recognize the different factors to be considered while migrating and has assisted you in making rational choices.

As a customer-centric Atlassian SSO vendor, we are committed in helping our server customers to who wish to take up Data Center Migration. We will be providing full support and maintenance for all our Server add-ons till 2024.

&nbsp;&nbsp; 

It’s hard to leave until you have to leave. Wishing you a smooth and easy migration.


&nbsp;&nbsp;

 
Contact Us – Drop us a mail at info@xecurify.com or [raise a ticket here](https://miniorange.atlassian.net/servicedesk/customer/portal/2) to talk to us.





By now, everyone is aware of Atlassian’s announcement on Server license discontinuation and selling new server license instances from Feb 2, 2021. If you have been living under a rock and missed the announcement.

Atlassian’s Server License Discontinuation: What are your options?


Atlassian's suite of applications such as Jira, Confluence, and Crowd, play critical roles in modern workplaces. Jira serves as a versatile project and issue-tracking tool, empowering teams to efficiently plan, monitor, and manage their work. Confluence, on the other hand, fosters collaboration by providing teams with a shared workspace for creating, sharing, and collaborating on content, thereby facilitating seamless knowledge sharing. Crowd acts as the linchpin of user authentication and authorization across multiple Atlassian products, offering a centralized solution for identity and access management.
While these tools have revolutionized productivity, their use has also highlighted the importance of robust Single Sign-On (SSO) solutions. As teams grow and projects become more complex, the need for robust SSO solutions has never been more pressing. SAML (Security Assertion Markup Language) SSO, a trusted approach, is often met with its own set of challenges, ranging from intricate configurations to user management complexities.
To conquer these obstacles, organizations are increasingly turning to SCIM DC – a transformative solution that promises to enhance SSO and identity management within the Atlassian ecosystem. In this bit, we will explore how SCIM DC can be the key to unlocking seamless, secure collaboration.

### The Foundation: Atlassian SAML SSO {#atlassian-saml-sso-foundation}

Atlassian's SAML SSO is a robust solution that allows users to access their applications seamlessly without the need to remember multiple passwords. With SAML, users authenticate once through their identity provider (IdP), and then gain secure access to their Atlassian tools, making the login process more efficient and secure. While SAML SSO solves the authentication challenge, managing user accounts, permissions, and access control remains a separate and complex task.

### The Challenge of User Provisioning and Management {#user-provisioning-channel}

As an organization grows, so does its user base and the complexity of user management. Adding and removing users, assigning appropriate roles and permissions, and keeping user data up to date are critical tasks. Without an efficient user management solution, organizations can face challenges related to compliance, security, and user experience. SCIM (System for Cross-domain Identity Management) DC is the missing piece that complements Atlassian's Native SAML SSO, providing a unified solution for both authentication and user provisioning. Let's explore…

### Unlocking the Magic of SAML SSO+SCIM {#saml-sso-and-scim}

SAML SSO+SCIM DC may sound like a mouthful, but it's actually a powerful addition that simplifies your online access. SCIM and Native SAML SSO are two separate but related technologies that can be used to enhance identity and access management in an organization. While they serve different purposes, they can complement each other to create a more robust and seamless authentication and authorization system. 

&nbsp;&nbsp; 

**Immediate User Provisioning**

One significant advantage of SCIM DC is the immediate user provisioning it offers. With SAML alone, there may be delays between a user being added to your identity provider and then gaining access to Atlassian applications. SCIM DC streamlines the onboarding process, enhancing user experience and productivity. **It eliminates the wait time for new users to access Atlassian applications, increasing efficiency and minimizing disruptions to your team's workflow.** Whether you're bringing in new team members or making updates to your existing user roster, SCIM DC's immediate user provisioning ensures that the right individuals have instant access to the tools they need.

### Advanced Group Management through Provisioning {#advance-group-management}

Let's talk about group mapping. In simple terms, this feature allows you to organize your access to different apps and services. You can create groups and decide who gets access to what. One of the common challenges faced by Jira administrators who set up SSO  is the difference in the groups at IDP with the groups in Jira. Here, SCIM DC automates group assignments. With SCIM, when users log in via SAML, they are automatically placed into the correct groups based on the information provided by your identity provider, such as Azure, miniOrange, or Okta. This eliminates the need for manual group mapping and ensures users have the right level of access.

### Seamless User Status Sync: {#user-status-sync}

Native SAML integration doesn't always keep user statuses synchronized. **For instance, when a user leaves your organization, you would typically have to deactivate their accounts manually within each Atlassian application. SCIM DC can sync user status changes across your Atlassian apps.** When a user is deactivated in your identity provider, SCIM DC will promptly deactivate their accounts in Jira, Confluence, and Crowd. This not only enhances security but also streamlines user management.

### Filter Groups with Custom Rules {#filter-groups-with-custom-rules}

With SAML alone, you might have limited control over which users get access to Atlassian applications based on their attributes, like department or role. SCIM DC allows for flexible group filtering. You can define rules in your identity provider to determine which users are provisioned into which groups within Atlassian applications. For example, you can set up a rule that automatically assigns all users with the "Sales" department in your identity provider to a "Sales Team" group in Atlassian or you can decide that only people whose names start with 'A' can access a particular app.

### Modify Group and Usernames {#modify-group-and-usernames}

Names are important identifiers, but sometimes they need a little tweaking. With SCIM DC, you can modify groups and usernames by applying special rules. It lets you modify group names that come from your IDP. So, if you're tired of seeing group names like "Sales123" and "Sales456," you can use regex to rename them to something clean and consistent, like "Sales." Or you can transform usernames using regex to match your organization's standards thus ensuring uniformity in user identities across all applications.

### Mapping and Customizing Attributes {#mapping-and-customizing-attributes}

Attributes are like the characteristics that make you unique. With Native SAML SSO+SCIM DC, you can map user attributes like username, email, and display name to attributes from your IDP. This ensures that everyone's profile stays up to date, no matter where they log in. In some cases, you might need to add custom attributes to user profiles, which can be challenging with native SAML integration. SCIM DC enables you to add custom attributes to user profiles. For instance, you can include an employee’s ID or a manager’s email of each user, to ensure that important information is readily available within Atlassian applications.

### In a nutshell… {#conclusion}

Atlassian SAML SSO+SCIM DC is your ticket to streamlining user management and boosting security. While SAML SSO ensures secure and streamlined authentication, the SCIM DC takes user provisioning and management to the next level. With automated user provisioning, role-based access control, real-time updates, and simplified onboarding, organizations can enhance their security, compliance, and user experience across Jira, Confluence, and Bitbucket.

&nbsp;&nbsp;  

So why wait? Embrace the power of Atlassian SAML SSO+SCIM DC as the integration offers a compelling solution, making it easier than ever to manage users in Atlassian's suite of collaborative tools. 

Reach us at +1 978 658 9387 for a demo or email your queries to [info@xecurify.com](mailto:info@xecurify.com), we would be glad to take it forward from there.


How can organizations efficiently manage user identities and access, across their Atlassian applications such as Jira, Confluence, and Crowd? This is a pivotal question posed to businesses in this era of ever-evolving workspaces, and digital teamwork as we rely heavily on collaboration and productivity tools to streamline our work processes.

Atlassian SAML SSO with SCIM DC: A Powerful Duo for Synergizing Atlassian's Applications


## Automate User Provisioning in Atlassian apps with miniOrange User Sync ⚙️ 👤 {#Automate User Provisioning in Atlassian apps }

Licensing has become a dicey subject and the budget pressure on companies is on an entirely different level. As your company grows, manually managing the entire Access Management is a hassle. For every user or employee of the company that uses Jira, Confluence or Service Management, they must have the necessary access rights in order for them to work efficiently. 

&nbsp;&nbsp;

Your Organization can suffer from a series of difficulties with manual process:

1. **Poor Onboarding Experience:** as new employees join, they wait for their Jira, Confluence account while the IT team take time off their schedule

&nbsp;&nbsp;

2. **Time Constraints:** With constant changes in organizations like promotions, revamped job descriptions, gaining the right access for employees is a time taking process. Without automated processes to align permissions and application access, the time taken to bring in these changes can sink your productivity.

&nbsp;&nbsp;

3. **Higher licensing Costs and Security Risks:** According to estimates, **30% of all Atlassian user licenses are unused**. This happens because users that leave the organization or change roles don’t have their accounts deactivated in a timely manner. This can have negative consequences, like exceeding license limits leading to an **increase in licensing costs**. Retaining access from former employees – poses a major security concerns. This is a major concern for confidential information of your company.

&nbsp;&nbsp;

You need to constantly make sure that the product access is limited to those who still have a valid business purpose and they have access to only what they have to need. **Manually provisioning users/groups makes it absolutely intolerable and inefficient. This not only increases the workload but also means duplicate work for the administrator.**

With the help of user provisioning the user accounts are automatically created, given proper permissions, and maintained across all Atlassian applications. 

1. Keep your Atlassian instances 100% accurate with user provisioning so that all your Atlassian users are up to date and have access to what they need. [User provisioning].

2. Disable, deactivate or delete inactive users (user deprovisioning) automatically after x days. 

3. Manage group membership on the Central Identity Provider to make sure every user has the right permissions and see the right projects. 

At this point you must be wondering how I can automate User provisioning in Atlassian applications. 


### How to Automate User Provisioning in Atlassian Cloud {#How to Automate User Provisioning}

[MiniOrange User Provisioning](https://marketplace.atlassian.com/apps/1222000/mo-scim-provisioning-user-sync-group-sync-for-jira?hosting=cloud&tab=overview) automatically synchronizes changes made in your identity provider into the Atlassian apps and keeps your Atlassian cloud access always up to date. With miniOrange user sync you will be able to do the following and manage your users more effectively:

1. No prerequisites are required – Atlassian Access is not required. 

2. Streamline the process of adding, updating as well as managing their access for Atlassian apps [User Provisioning].

3. Whenever a user is deactivated in the identity provider, user Sync automatically deprovision/disable them in your Atlassian apps in the next sync and ultimately save licensing costs. [ User Deprovisioning].

### How to Automate User Provisioning in Atlassian Data Center {#How to Automate User Provisioning in Atlassian Data Center}

With the help of [miniOrange User Provisioning](https://marketplace.atlassian.com/search?query=miniOrange%20user%20sync), changes in your identity provider will be synchronized in Atlassian apps with one click. 


1. **Synchronize User Directories:** with user directories being synchronized, new users will automatically be added in the respective Atlassian applications. You can also schedule synchronization which provides proactive provisioning and de-provisioning of users and groups at regular intervals (sync).

2. **Default Group Mapping:** assign default groups in your Jira instance for each synced user and make sure that they are given the application access and not removed during a sync.

3.**Manual Group Mapping:** Assign permissions to users even if groups don’t match between IDP and Atlassian instance. 

4. Compatible with using [miniOrange SAML SSO](https://marketplace.atlassian.com/search?query=saml%20miniOrange) for authentication.


Additional functionalities provided in miniOrange User Provisioning

- Scheduled User Synchronization via API 
- Attribute Mapping 
- Username and Group Transformation 
- Supports SCIM 1.1 and SCIM 2.0 protocols
- Filter users by groups & filter groups to be assigned & removed  

### Conclusion: {#Conclusion}

Automating User Provisioning is not an option, it’s a must for any modern enterprise that takes security and usability seriously. It’s really easy to manage users automatically via our developed user provisioning add-ons which can be connected with your IDPs ([Azure AD](https://miniorange.in/atlassian/jira-scim-user-and-group-provisioning-for-azure-ad), [Okta](https://miniorange.in/atlassian/jira-scim-user-and-group-provisioning-for-okta), [OneLogin](https://miniorange.in/atlassian/jira-scim-user-and-group-provisioning-for-onelogin)) or any other SCIM compliance applications so when you setup your Jira Azure AD SCIM or Jira Okta SCIM, user sync plugin will make it a cakewalk for you.  

The add-on also works with [Single Sign On](https://marketplace.atlassian.com/search?query=miniOrange%20Single%20Sign%20On%20) where SSO is used for authentication and User sync application is used for automatic provisioning. You can also check out our other user Management add-ons on the Marketplace which helps removing unused licenses and ultimately save licensing costs for all your Atlassian instances.

Licensing has become a dicey subject and the budget pressure on companies is on an entirely different level. As your company grows, manually managing the entire Access Management is a hassle.

Automate User Provisioning in Atlassian apps with miniOrange User Sync ⚙️ 👤


## SSO for Atlassian Applications connected to Crowd

Crowd is a centralized identity and access management application that manages the users from multiple directories like Active Directory, LDAP, Open LDAP, Microsoft Azure Active Directory for connected applications such as Jira, Confluence, Jenkins etc. This makes access to applications without logging into each individually a lot simpler with a single set of credentials.

Now, organizations are looking to delegate user authentication for Atlassian applications from Crowd to central IAM (Identity & Access Management) applications for better security and allow their users to seamlessly access all the Atlassian applications connected to crowd including Jira, Confluence, Bitbucket, etc using the single IAM session.

There are multiple solutions available to achieve these requirements:
- In case you have an Atlassian Data Center application, you can integrate each application with IAM for SAML SSO using the application’s built-in SSO 2.0 functionality. 
- In case you have a Server version or looking for customization and other features not present in built-in SSO 2.0, take a look at the SSO plugins available on the Atlassian Marketplace.
- Use Crowd SSO for user and permission management and if you want to prevent applications from directly integrating with IAM.

Here we will be focusing on the third solution only, using this solution, all authentication requests and responses to and from Atlassian applications will go through the Crowd server and user authentication will be handled by the IAM while the Crowd will still be used to manage users and their permission for the Atlassian applications.

### How does the miniOrange plugin handle this use case? {#miniorage-plugin-solution}

We developed a SAML Single Sign-on app for Crowd Server that allows it to integrate with any SAML complaints IDP for SAML Single Single Sign-on.

Along with the Crowd SAML Plugin, we have developed its connector add-ons for the Atlassian application, which allows the [Crowd SAML SSO](https://marketplace.atlassian.com/apps/1218304) plugin to enable SSO and Atlassian applications connected to crowd such as [Jira](https://marketplace.atlassian.com/apps/1220053), [Confluence](https://marketplace.atlassian.com/apps/1220055), [Bitbucket](https://marketplace.atlassian.com/apps/1220057), [Bamboo](https://marketplace.atlassian.com/apps/1220056), and [Fisheye](https://marketplace.atlassian.com/apps/1222983). Here, users don’t need to login to Crowd for SSO to work, they can directly do so from their Jira or Confluence application.

**Crowd SSO Plugin and it’s Connectors:**
- [Crowd SAML SSO plugin](https://marketplace.atlassian.com/apps/1218304/mo-saml-single-sign-on-sso-for-crowd?hosting=server&tab=overview)
- [SSO Connectors for Crowd and JIRA](https://marketplace.atlassian.com/apps/1220053/mo-sso-connector-for-crowd-and-jira?hosting=datacenter&tab=overview)
- [SSO Connectors for Crowd and Confluence](https://marketplace.atlassian.com/apps/1220055/mo-sso-connector-for-crowd-and-confluence?hosting=datacenter&tab=overview)
- [SSO Connectors for Crowd and Bitbucket](https://marketplace.atlassian.com/apps/1220057/mo-sso-connector-for-crowd-and-bitbucket?hosting=datacenter&tab=overview)
- [SSO Connectors for Crowd and Bamboo](https://marketplace.atlassian.com/apps/1220056/mo-sso-connector-for-crowd-and-bamboo?hosting=server&tab=overview)
- [SSO Connectors for Crowd and Fisheye](https://marketplace.atlassian.com/apps/1222983)

### How does it work? {#how-does-it-work}

Crowd SAML SSO Plugin acts as a SAML Service Provider and is used to enable trust between Atlassian applications and central IAM applications. Crowd SAML SSO plugin takes care of the SAML Request, SAML response, and user’s session management across all the Atlassian applications, and using the SSO connector for Crowd, users will be able to invoke SSO directly from the Atlassian applications itself.

Here, user authentication will be done by the IAM and Crowd will still be used to manage users and their groups (permissions) for all the connected Atlassian applications connected to crowd.

Also, with this flow, end-users will experience a seamless login and won’t be able to notice that the SSO request and response passes through the Crowd Server.

**Let’s understand the Workflow!**

- User tries to access the application i.e., Jira tickets, Confluence pages, etc
- User will be redirected to the IAM application’s login page for authentication.
    - Users will be redirected to the Crowd SAML plugin.
    - Crowd SAML plugin will redirect the user to the IAM application for authentication.
- Once the authentication is done, the user will be redirected back to the Atlassian applications connected to crowd and logged in.
    - IAM sends a response back to Crowd SAML plugin
    - Crowd SAML plugin validates the SAML Response and takes care of the  user creating the user session, and redirects the user to the respective application from where the SSO was invoked.
    - Users will be granted access to the application based on their groups and applications configured on Crowd.

### What are the Key Benefits? {#what-are-key-benefits}

- There is only one set of SAML configurations for all the Atlassian applications.
- User authentication is moved to central IAM without losing any of the existing user permissions.
- Users will be able to access all applications (Atlassian and Non-Atlassian applications) using their IAM credentials.
- This solution made setup easy to enforce an additional security layer like MFA on top of the SSO which was not possible while using Crowd for Single Sign-On.

What do you think of this solution? Do you think this would be helpful in centralizing authentication for your users? Drop us a mail at [info@xecurify.com](mailto:info@xecurify.com) or raise a ticket [here](https://miniorange.atlassian.net/servicedesk/customer/portal/2) to talk to us.

Jira Service Management (JSM) is a powerful service management solution designed to streamline your support processes. However, JSM portals often face the challenge of dealing with spam tickets generated by malicious actors or automated bots, especially if it’s a public-facing platform.

SSO for Atlassian Applications connected to Crowd


### Double-Up your Atlassian Security with MFA! {#double-up-your-atlassian-security-with-mfa}

miniOrange stands as a reputed partner and provider of security and SSO solutions for multiple platforms being WordPress, Joomla, Shopify, Drupal & many more, within the industry. Built on a strong foundation of security fundamentals, we provide secure and reliable Identity and Access Management (IAM) solutions that integrate seamlessly with the customer’s existing frameworks. We provide SSO solutions for all the Atlassian applications using protocols like SAML, OAuth 2.0, OIDC, etc. SSO enables users to securely authenticate with multiple applications by logging in only once – with just one set of login credentials. miniOrange has grown from its initial size of 4 to 150+ now. The company was built from the ground up by a group of experienced technology architects, with a background in security themselves.


Unwilling to continue in their day jobs, the team began miniOrange. Having a deep understanding of security, the miniOrange team applies their technical expertise to create unique and helpful solutions to the needs and challenges of the industry. The company aims to give organizations the ability to securely manage access to all of their web based applications in one place. We are growing day by day and will continue to do so!

&nbsp;&nbsp;

The miniOrange’s expertise in Identity And Access Management (IAM), Single Sign-On, Multi-factor Authentication, Network Security, API Security, Cyber Forensics. The central focus of our products and company revolve around these themes. Our solutions are specific, accurate and, most importantly, great at doing what they’re supposed to: Making you more secure!


### What is MFA/2FA ? {#what-is-mfa/2fa}

Multi-Factor Authentication (MFA) is an authentication method that requires the user to authenticate themselves for two or more factors, in order to gain access to company resources, applications, or a VPN. Enabling Multi-Factor Authentication (MFA) means that users need to provide additional verification factors apart from their username and passwords. These second-factor methods can range from OTP over SMS, OTP over Email, Push notification, Google/Microsoft authenticator, and many more. 

&nbsp;&nbsp;

Having this extra layer of security ensures that the information being accessed is well protected from activities such as phishing, malware, hacking, and many more. Having a strong MFA setup ensures a robust Identity and Access Management (IAM) for your organization and secures your resources.

![2fa](/blog/assets/2023/configure-two-factor-authentication.webp)


The goal of leveraging MFA is to boost security and make a layered defense so that even if one factor (username-password) is stolen, the cyber attacker still has at least one more barrier to breach before successfully breaking into the actual targeted device. The second barrier is also usually harder to breach as compared to simple username passwords.

### How does it work? {#how-does-it-work}

One of the first steps of access control is the identification and authentication of users. There are three common factors used for authentication:

- Something you know (such as a password)
- Something you have (such as a smart card)
- Something you are (such as a fingerprint or other biometric method)

Identification occurs when a user professes an identity (such as with a username), and authentication occurs when users prove their identity. For example, users are authenticated when they provide both their username and correct password. Permissions, rights, and privileges are then granted to users based on their proven identity.

![MFA](/blog/assets/2023/mfa.webp)

### Our Products {#our-products}

![products](/blog/assets/2023/our-mfa-products.webp)

&nbsp;&nbsp;


We offer MFA for Server, Data Center & Cloud. 

- For Server & Data Center, it’s available for **Jira, Confluence, Bitbucket, Bamboo & Crowd.**
- For Cloud, we have a solution available for **Jira, Confluence and Bitbucket.**

### Features Our MFA Addons Provide {#features-our-mfa-addons-provide}

#### Supported MFA Methods

We have highest number of supported methods for MFA:
Mobile Authenticator (TOTP)

1. OTP over Email
2. OTP Over SMS
3. Hardware Token (Yubikey)
4. WebAuthn
5. Duo Push Notification
6. Backup Methods
7. Security Questions
8. Backup Codes

Admin options for User management

1. Enable 2FA for Jira Software and/or Jira Service Desk
2. Choose 2FA methods for end users
3. Enable, Disable & Reset 2FA for users 
4. Enable 2FA based on groups
5. Skip 2FA for a specific group

### Security {#security}

#### 2FA for Jira Service Desk 

2FA for Service Desk is the most used feature of our addon. In organizations, there are two types of users – one is employees and the other is customers. 

The employees use multiple applications (Jira, Confluence, Bitbucket, Jenkins, Sonarqube, etc) and usually there is one central application used to manage all the users at one place, which is known as an IDP(Identity provider). So organizations connect all the applications to the IDP and users login using Single Sign on. And along with Single sign on, they also enable second factor authentication on the IDP itself. 

In Jira Service Desk, as the customers are unlicensed users, they are usually managed on the Jira itself. We allow 2FA for those customers as well. 


#### Brute Force Protection

Brute Force Attacks are hacking methods that use trial and error methods to guess user credentials and gain unauthorized access. 

In the case of 2FA,  there are Brute Force 2FA Attacks. Here hackers first get the credentials and then try all the combinations of the OTP code (which is generally 6 digit) to gain unauthorized access.

Using the Brute force protection feature, you can restrict the number of continuous invalid 2FA attempts, making it impossible for the hacker to guess the OTP.

### Usability {#usability}

#### IP Whitelisting 

Here you can whitelist a range of IPs and the plugin will skip 2FA if the user is trying to login there which improves the usability of users. 

During the pandemic many organizations introduced 2FA. As employees started working from home, they were no longer logging in from the secure company’s Network. So it becomes easier for intruders to get into systems. And to solve this issue, they introduced 2FA. 

Here the IP whitelisting feature helps improve the usability of the employees. The admin can whitelist all the IPs inside the company network. So now if an employee tries to login from within the company’s network then 2FA will be skipped for that user. And if the same user tries to login to Jira from home (via some other laptop or from mobile phone) then the 2FA will be enforced.

#### Remember My Device

This feature helps a user mark some devices as trusted devices. 

So from next time 2FA will be skipped on that device for that user. So users don’t have to enter the 2nd factor again and again.

### 2FA For Atlassian Cloud {#2fa-for-atlassian-cloud}

To enable MFA on Atlassian cloud, you need Atlassian Access. It is a separate module created by Atlassian to provide functionalities like Single Sign on, 2FA and user management for all the cloud applications.

It supports two 2FA methods.

- Mobile Authenticator
- Backup Codes.

If these 2FA methods are sufficient to your organization then you can directly use Atlassian Access. 

**There are two limitations in Atlassian Access:**

1. It supports only 2 basic 2FA methods.
2. It does not allow using SSO and 2FA at the same time for a user.
miniOrange cloud 2FA solution overcomes these limitations. There are a total 3 important use cases where miniOrange cloud 2FA solution will be used:

**Case 1:**

Suppose you are already using 2FA methods like OTP over Email in your organization and you want to enable the same for Atlassian Cloud apps. Then Atlassian Access won’t be sufficient. Here you can use the miniOrange solution where almost all the 2FA methods are supported.

![2fa-methods](/blog/assets/2023/methods-of-2fa.webp)

**Case 2:**

Second case is, your users are stored on an Identity Provider(IDPs), your users login using SSO into Atlassian Applications and you want to enforce 2FA for your users. As Atlassian Access does not allow SSO and 2FA at the same time, it adds a compulsion on Identity Providers to have inbuilt support for Two Factor Authentication. But even many popular Identity Providers like ADFS, Keycloak, Auth0 and Shibboleth don’t support 2FA. Here miniOrange Identity Broker Solution can be used.

![atlassian-cloud](/blog/assets/2023/atlassian-cloud.webp)

**Case 3:**

Third case is, your users are stored on an IDP and your IDP supports 2FA as well. But it does not support the 2FA method that you want, (which you are already using in your organization).

**Contact:  atlassiansupport@xecurify.com**
**Visit: [www.miniorange.in/atlassian](https://www.miniorange.in/atlassian)**

Multi-Factor Authentication (MFA) is an authentication method that requires the user to authenticate themselves for two or more factors, in order to gain access to company resources, applications, or a VPN.

Double-Up your Atlassian Security with MFA!


## Elevating ITSM with Jira Service Management {#fortify-your-defenses}

IT service management platforms (ITSM) facilitate workflow management and data collection so businesses can plan, automate, control, and deliver seamless digital experiences. [According to the Gartner report Magic Quadrant for IT Service Management Platforms](https://www.atlassian.com/gartner/magic-quadrant-it-service-management-tools#:~:text=31%20October%202022.-,Atlassian%20is%20a%20Leader%20in%20the%202022%20Gartner%C2%AE%20Magic,service%20marks%20of%20Gartner%2C%20Inc.), Atlassian, with its Jira Service Management, is a leader in this area. In the ever-evolving landscape of IT service management (ITSM), seamless service delivery isn't just a goal; it's a necessity. 

&nbsp;

However, with the exchange of sensitive data being the norm, security isn’t just an option, it’s become the cornerstone of trust in such applications. Ensuring robust security for external customer portals has become paramount. Many organizations grapple with the challenges of Single Sign-On (SSO) integration and the complexities of managing a multitude of customer accounts. These hurdles can impede the seamless operation of Jira Service Management (JSM) Cloud, creating roadblocks for both businesses and their valued customers.
What was once a challenging endeavor has now been simplified with a groundbreaking solution: [SAML/OAuth SSO for JSM Customers](https://www.miniorange.in/atlassian/sso-for-jsm-customers) brought to you by [miniOrange](https://www.miniorange.in/).

&nbsp;

In this article, we delve deep into the realm of security enhancements, shedding light on the transformative capabilities of SSO for portal-only customers within the JSM Cloud environment and a couple of other extensions that would add value to your ITSM.


### Enhancing Security for Portal-Only Customers in JSM {#enhancing-security-for-portal-only-customers}

Single Sign-On (SSO) capabilities have been a significant challenge for Jira Service Management (JSM) Cloud users, particularly those with portal-only customers. Managing thousands of customer accounts can become cumbersome. However, imagine the convenience of allowing external customers to log in via SSO to your JSM portals. **miniOrange presents an exclusive solution** – [SAML/OAuth SSO for JSM Customers](https://www.miniorange.in/atlassian/sso-for-jsm-customers).
Our app extends SAML SSO capabilities to portal-only customers effortlessly. You only need to connect to your identity provider (e.g.miniOrange,Okta, AzureAD) through the app, enabling a secure and streamlined authentication process for external customers. 

&nbsp;

![Configuring SSO With Multiple Identity Provider](/blog/assets/2023/jsm-configure-idps.webp)

&nbsp;

Once authenticated through their identity provider, users establish a session on the JSM portal. With this session, they can access and monitor the progress of their tickets and perform relevant actions. This solution grants users access to the portal using their existing authentication credentials from a trusted identity provider.

&nbsp;

Let's explore how these improvements can empower your IT service management.

### Unlocking the Benefits {#unlocking-the-benefits-empowring-itsm-enhanced-security}

Enhanced security measures for portal-only customers within Jira Service Management Cloud offer not just protection, but a gateway to a world of advantages that elevates your IT Service Management (ITSM) strategy.

**Enhanced Security:**

By adding an additional layer of authentication, it ensures that your external customers must prove their identity before accessing the portal. This helps verify the legitimacy of users and prevents automated bots from creating accounts and submitting spam tickets easily.

![Mapping your specific customer portals](/blog/assets/2023/portal-access-management.webp)

&nbsp;


**Centralized User Management**

Leveraging an identity provider allows you to maintain a single source of truth for user identities and access controls of your external customers.
In addition to these benefits, our integration offers some notable features:

- Support for both SAML + OAuth/OIDC Protocols: This support allows you to seamlessly connect Atlassian Cloud to your OAuth/OIDC provider, ensuring a smooth authentication experience.

- Organization Mapping Based on Customer Domains and IDP Groups: Automatically assigns customers to specific organizations based on email domains and IDP groups, streamlining support workflows.

![Mapping your organizations based on email domains](/blog/assets/2023/organization-mapping.webp)

&nbsp;

- Multiple Identity Provider (IDP) Support: Users can choose from different trusted authentication sources when logging into the system.
- Two-Factor Authentication (2FA) on top of SSO: Adds an extra layer of security by requiring two forms of verification before granting access, enhancing portal security.
-  Easy User Management and Custom Domain Support: Simplifies user management, audit logs, and troubleshooting with quick access to help center links and configurable ticket fields.

&nbsp;

While [SAML/OAuth SSO for JSM Customers](https://marketplace.atlassian.com/apps/1229212/saml-oauth-sso-for-jsm-customers?hosting=cloud&tab=overview) addresses the pressing issue of security and user management in ITSM, a well-rounded ITSM solution demands more. As organizations of all sizes embrace Jira Service Management, we delve deeper into its core functionalities and explore how it fosters collaboration among development, infrastructure, and business teams.


### How to boost Jira Service Management {#how-to-boost-jira-service-management}

To truly enhance the customer-agent relationship and improve workflow efficiency, additional functionalities are often necessary in Jira Service management. Agents frequently encounter challenges such as insufficient information or delays in ticket resolution due to waiting for customer responses. This is where solutions like **'Customer and Organization Management' or ‘Feature Bundle for Jira Service Management' by Appsvio come into play**. Let’s check these extensions out…


&nbsp;

![Jira Customer Fields](/blog/assets/2023/jira-customer-fields.webp)

&nbsp;


**Customer and Organization Management**

This app addresses the information gap by facilitating fast and easy data gathering. It allows agents to collect additional customer context directly from the issue view. Customizing forms is straightforward; users can select field types and drag and drop them into the customer view. The collected data can be used to define JQL and SLA criteria, expediting request creation by copying values from the customer's profile to the issue.

&nbsp;

![Mapping your organizations based on email domains](/blog/assets/2023/troubleshoot-jira-ticket.webp)

&nbsp;

Customer and Organization Management also supports bulk actions, making it possible to assign customers to projects and organizations efficiently. This not only saves time for agents but also enhances communication by providing easy access to customer and organization information.


## Feature Bundle for Jira Service Management {#feature-bundle-of-jira-service-management}

Effective communication with customers is another key aspect of the Jira Service Management Portal. The 'Feature Bundle for Jira Service Management' offers banner functionality, enabling businesses to keep customers well-informed without inundating them with emails and announcements.
It's time to put more into customers' hands! With this feature, you can allow customers to edit their requests. Changing minds is natural. Why engage agents every single time to apply changes? Imagine that you have to modify dozens of requests one day – a waste of time. In our scenario, customers can decide on their own and make changes with ease.

&nbsp;

As an admin, you can define who is able to edit the request: Reporter/Participants/ Organizations. Appsvio once again uses drag-and-drop functionality to make it possible to create a form. Decide which fields can be edited. What’s interesting, it also supports Assets formerly known as Insight, so you can customize it as you need. 

&nbsp;


Another feature that empowers customers’ is the ability to display a customer's workflow can greatly improve the customer experience. Similar to tracking a package delivery, customers can now see where their requests stand in the process. With Feature Bundle, you can add workflow information to the request view and define conditions for when steps change, providing customers with real-time updates.

![Workflow displayed on the request view](/blog/assets/2023/workflow-display.webp)

## Final Word {#final-word}

Jira Service Management and SSO Integration are powerful tools in the realm of ITSM. While SSO Integration enhances security and user convenience, Jira Service Management thrives when complemented by extensions like 'Customer and Organization Management.' These solutions collectively empower ITSM to meet the evolving needs of businesses, ensuring seamless digital experiences for customers and streamlined operations for teams. Together, they represent a comprehensive approach to ITSM that drives efficiency, security, and customer satisfaction.

&nbsp;

Try out our plugin today at the Marketplace - [SAML/OAuth SSO for JSM Customers](https://marketplace.atlassian.com/apps/1229212/saml-oauth-sso-for-jsm-customers?hosting=cloud&tab=overview). If you have any other security requirements for Atlassian Cloud, do reach out to us at info@xecurify.com and we’ll surely help you out. 
Reach us at +1 978 658 9387 for a demo or email your queries to info@xecurify.com, we would be glad to take it forward from there. And you can also visit [Appsvio](https://www.appsvio.com/). 



Single Sign-On (SSO) capabilities have been a significant challenge for Jira Service Management (JSM) Cloud users, particularly those with portal-only customers. Managing thousands of customer accounts can become cumbersome. However, imagine the convenience of allowing external customers to log in via SSO to your JSM portals.

Elevating ITSM with Jira Service Management: A Spotlight on Security and Customer Service


## Enable Jira 2FA for Customers and skip for Employees

Every day, you read about data breaches and password leaks in the news. You might believe that this only happens to people who have outdated systems or poor security. What about you though? Cybercriminals can easily gain access to your organization’s confidential data using unprotected passwords used by your employees or customers.

But the battle isn’t lost.

[Single sign-on (SSO)](https://www.miniorange.in/single-sign-on-sso) and [Multi-Factor Authentication (MFA)](https://blog.miniorange.in/what-is-multi-factor-authentication-mfa/) are industry-standard solutions for addressing these issues, and they can help to mitigate security threats. Hence, you must ensure that all of your users use strong passwords and two-step verification.

This article will walk you through how to secure the accounts of both your employees (Internal Users) and Jira Service Management customers (External users). We will configure SSO and 2FA for the employees and then enable Jira 2FA for customers. Let’s start step by step!

![Jira 2fa for customers](/blog/assets/2023/jira-2fa-for-employees.webp)

### How to Secure Your Customers? (2FA) {#how-to-secure-your-customers}

Your employees’ accounts are now safe because you enabled SSO and 2FA on IDP for them.

The challenge now is determining how to keep your customers (external users) secure.

This is where miniOrange two-factor authentication comes in handy. Using the [miniOrange Two Factor Authentication(2FA)](https://marketplace.atlassian.com/search?query=MINIORANGE%202FA) plugin, you can enable Jira 2FA for customers as well.

Concerned that enabling 2FA for Jira will require your employees to verify the 2FA twice(once on the IDP and then on the Jira again)? Don’t worry. The miniOrange plugin allows you to enable 2FA for a subset of users. As a result, you can enable Two Factor Authentication/2FA only for your customers on Jira, while all of your employees will continue to use Single Sign-On (SSO) and 2FA on your IDP.

![Jira 2fa for customers](/blog/assets/2023/jira-2fa-for-customers.webp)

### miniOrange 2FA Use Cases {#miniorange-2fa-use-cases}

The miniOrange Two Factor Authentication(2FA) add-on is highly flexible and can be configured to fit your requirements perfectly. It provides custom configuration options to manage 2FA for all sets of users like 2FA for customers, Two Factor Authentication for employees, admins, remote users, service desk agents, and more. Some of these combinations are listed below –

- 2FA for all the users (internal users and external users)
- 2FA for Jira only for a set of users or groups
- 2FA for all the users except some set of users.
- 2FA only for the service desk agents (Service Management) 
- 2FA for customers and SSO for employees (which is covered in this Article)
- 2FA for users accessing from outside company office (based on IP)
    - For example, skip 2FA if a user accesses Jira from within the Office campus and ask for 2FA/MFA verification if the same user accesses Jira from home.

Give it a try and start your evaluation today for Two Factor Authentication Add-on! This app is available for [Jira](https://marketplace.atlassian.com/apps/1221260/mo-two-factor-authentication-2fa-for-jira?hosting=datacenter&tab=overview), [Confluence](https://marketplace.atlassian.com/apps/1221328/mo-two-factor-authentication-2fa-for-confluence?hosting=datacenter&tab=overview), [Bitbucket](https://marketplace.atlassian.com/apps/1221920/mo-two-factor-authentication-2fa-for-bitbucket?hosting=datacenter&tab=overview), [Bamboo](https://marketplace.atlassian.com/apps/1222869/mo-two-factor-authentication-2fa-for-bamboo?hosting=server&tab=overview) and [Crowd](https://marketplace.atlassian.com/apps/1224960/mo-two-factor-authentication-2fa-for-crowd?hosting=server&tab=overview).

You can follow the step-by-step setup guide to configure Two Factor Authentication Add-on for [Jira](https://miniorange.in/atlassian/jira-two-factor-authentication-2fa), [Confluence](https://miniorange.in/atlassian/confluence-two-factor-authentication-2fa), [Bitbucket](https://miniorange.in/atlassian/bitbucket-two-factor-authentication-2fa), [Bamboo](https://miniorange.in/atlassian/bamboo-two-factor-authentication-2fa) and [Crowd](https://miniorange.in/atlassian/crowd-two-factor-authentication-2fa-mfa) applications.

In case you have any other use cases or have any queries, then please feel free to raise a ticket [here](https://miniorange.atlassian.net/servicedesk/customer/portal/2).

Enable Jira Two Factor Authentication (2FA) for customers & skip for Employees. Secure internal & external users by configuring 2FA for Jira. Our add-on is highly flexible and can be configured to fit your requirements perfectly. It provides custom configuration options to manage 2FA for all sets of users like 2FA for customers, Two Factor Authentication for employees, admins, remote users, service desk agents, and more.

Enable Jira 2FA for Customers and skip for Employees


APIs have become the backbone of modern digital systems, enabling seamless communication between applications and services. However, they’ve also become a prime target for cyberattacks.

According to TechTarget's report Securing the API Attack Surface, 92% of surveyed organizations experienced at least one API security incident in 2023.

A recent high-profile breach, attributed to compromised user credentials in a leading enterprise system, is a stark reminder of just how devastating vulnerable APIs can be. But what if securing your APIs didn’t have to be a complex, resource-intensive task?

The solution is simpler than you might think: the **Enhanced API Authentication Plugin for Jira**. This powerful tool by miniOrange helps you fortify your REST APIs with ease, covering critical security needs without any technical hurdles.

Here’s how it works and why it’s a must-have in today’s API-driven world.


### Why API Security Can’t Be Ignored {#why-api-security-cant-be-ignored}

Every REST API endpoint is a potential gateway to your system’s sensitive data. Without robust security measures, these gateways can reveal critical information, including system configurations and user details—even to unauthorized users.

For example, APIs often rely on default authentication methods, such as basic username and password setups, which are highly vulnerable to attacks like credential stuffing and brute force. This isn’t just a risk for large organizations; **50% of all API traffic is unmonitored**, leaving many endpoints exposed to attacks like injection, DDoS, and man-in-the-middle exploits.


### How miniOrange Enhanced API Security App Protects Your Data {#protects-your-data}

Our app addresses these challenges head-on, providing a comprehensive security layer for your REST APIs:
- **Authenticate Every Access Request :** Think of your API endpoints as virtual doorways to your data. Without proper locks, anyone can sneak in. The miniOrange app ensures that **only authenticated users :** gain access to your APIs. By blocking unauthorized users, it keeps your server details and sensitive data safe from prying eyes.
- **Granular Access Controls:** Not every user should have access to every piece of information. With our app, you can define **precise permissions** for user groups or individuals, ensuring that only trusted users can interact with specific APIs. This minimizes the risk of accidental data leaks or misuse.
- **Replace Outdated Credentials with Secure Tokens :** Traditional username and password setups are no match for modern threats. Our app replaces this vulnerable method with **token-based access**, which uses secure, encrypted tokens to authenticate users. This approach significantly enhances security while making API access easier to manage.
- **Control Token Generation :** To further tighten security, the app allows admins to control who can generate API tokens. Think of it as issuing secure access badges—only your most trusted team members can grant or manage API access, reducing the chances of unauthorized token creation.


### API Security: A Rising Priority in 2024 {#api-security-priority-2024}

API security is no longer optional—it’s a necessity. Here are some trends that highlight the urgency:
- **Increased API Usage :** Gartner predicts that by 2025, **APIs will account for more than 90% of web application attack surfaces**.
- **Stricter Compliance Requirements :** Regulations like GDPR and CCPA now demand higher accountability for securing API data, with penalties for non-compliance.
- **Shift to Zero Trust :** Adopting Zero Trust means prioritizing API security to protect sensitive data and applications, ensuring no entity is trusted by default.


### Why Choose miniOrange Enhanced API Security App? {#why-choose-miniorange-api-app}

The miniOrange app is designed with one goal: to simplify and strengthen your API security so you can focus on what matters most. Whether you’re dealing with sensitive customer data or critical system operations, our app ensures your APIs are locked down without requiring a steep learning curve or technical expertise.

And if your business has unique API security needs? We offer tailored solutions to meet your specific requirements, so you’re never left vulnerable.


### Secure Your APIs Today {#secure-your-api-today}

Don’t wait until a breach forces your hand. Take proactive steps to secure your REST APIs with the **Enhanced API Authentication Plugin for Jira**.

Get in touch with our team to learn more or request a personalized demo. Together, we can close the gaps in your API security—effortlessly.


Reach out to us at **support-atlassian@miniorange.atlassian.net** or raise a support ticket by [clicking here.](https://miniorange.atlassian.net/servicedesk/customer/portal/2)

Discover how to safeguard your REST APIs with ease using the miniOrange Enhanced API Authentication Plugin for Jira. Block unauthorized access, implement token-based authentication, set granular permissions, and protect sensitive data from modern cyber threats.

REST API Security: How to Secure Your REST APIs Effortlessly


## Ensuring Secure Sharing of Confluence Pages with External Users: The miniOrange Approach

[Share Confluence with External Users (Secure Share)](https://miniorange.in/atlassian/confluence-secure-share-external-share#:~:text=Confluence%20Secure%20Share%20Page%20allows%20you%20to%20share,via%20an%20access%20link.%20Try%20It%20Free%20Documentation) came into being with the thought that today’s businesses would not only benefit from using an app that would save their **licensing cost** but also provide a safe and secure way to share Confluence with external users.

Outsourcing, collaboration internal or external to get a project completed on time is what keeps a business relevant and afloat in today’s world. In this era of Information Technology, the marketplace is abuzz with collaboration tools, among the leading ones is ‘Confluence.’

If you work on projects using Confluence which involves sharing documents, pages or collaborating directly with vendors, clients, and customers, then it becomes necessary to share that page/space with external users or non-Confluence users. In other words, any unlicensed user with your organization and does not have access to your confluence page becomes an external user.

Then again, you may want your external users to have limited or restricted access to the pages. It entirely depends on the role the intended external user would play. Are they just going to view the pages or also contribute to it by making changes? Would they be restricted to the main page or would they have access to the child pages as well? This is where the ‘Secure Share (Confluence with external users)’ plugin comes in, let’s dive in a bit more…

![Secure Share](/blog/assets/2023/miniorange-secure-share.webp)

### Beginning with the challenges {#beginning-with-the-challenges}

The first thing that comes to mind when one has to share the workspace with external users is data security, sharing sensitive information such as project details in a way that they comply with your company’s data protection regulations and also is secure from being accessed by an unauthorized user.

The other challenge is the licensing cost of adding new users to the workspace as the external users may not have an Atlassian account or confluence license. Projects executed with external collaborations incur huge costs and one of those costs is acquiring license for them to work on the same platform.

Once that’s settled, the question arises of the kind of control or access that needs to be provided to the external users. Can we securely assign granular levels of access as needed or just restrict them to pages specific to their role and work? Many would relate with occasions wherein one had to share snapshots of the projects, PDFs, or invite external users to their office to discuss details, all time consuming and also at times it might not sit well with internal compliance. That brings us to…

### What is Confluence Secure Share {#what-is-confluence-secure-share}

Think if you had to make your whole space public on the internet to externally share your Confluence pages with non-licensed users, it would make it vulnerable to security threats. There might be times or the need of your project that all parties to it do not have full access to your confluence pages.

Developed by miniOrange, **‘Secure Share’** enables you to **generate secure, unique links** to the Confluence pages and share them with external non-confluence users without making it public. With its in-built features, it allows you to share Confluence pages with **limitations and controls** that you can apply to protect your data. Not only that you can **password protect** it and also set an **expiration time** so that it becomes inaccessible after a specific period.

### Features At a Glance {#features-at-a-glance}

-   Unique access links for any Confluence pages/spaces can be created, secured, and shared
-   Set permissions for end-users to View/Add Comments/Attachments in the shared pages
-   Password-protect your shared link with your own password or generate a random one for better security
-   Set validity for the shared link thus adding another layer of security
-   Deactivate/delete the shared link according to your convenience
-   Easily share your access links via SMTP
-   With Subscribe to link feature, external users would be notified about any changes to the page/space

When using Confluence, the challenge is how to share pages with those outside your organization who do not have a Confluence account. Our solution **“Secure Share”** answers that.

### Last But Not the Least {#why-choose-miniorange-secure-share}

miniOrange’s suite of apps are dynamic in nature, our developers are constantly at work finding the next best app feature that would enhance the existing app’s performance. With **“Secure Share”** you can look forward to certain features that would be added soon, a glimpse of what’s upcoming:

**Enable SSO for the anonymous user preventing unauthorized access:** Adding an extra layer of security, the admin can enable the user to perform SSO before accessing the secure share link.

**Editing would also be made possible soon:** Yes, we took the feedback of our clients into consideration and soon would be releasing the feature where anonymous users can edit the confluence page using the access link shared with them.

**Maintain user logs of those who have access to the shared link:** Keep track of those who have access to the shared link and maintain accountability and control over their shared content.

Our demo and support services would be glad to help you understand how our apps can add value to your business.

With our exceptional customer service, you can be assured that we’ll be there every step of the way. Visit the [Atlassian marketplace](https://marketplace.atlassian.com/vendors/1213308/miniorange) for our other apps and see what sets them apart from the rest.

So, if you feel that this is the app that you want to go for, we would assist you with a free app setup or you can contact us at **+1 978 658 9387** for a demo. For any queries do reach out to us at **info@xecurify.com.**


Developed by miniOrange, ‘Secure Share’ enables you to generate secure, unique links to the Confluence pages and share them with external non-confluence users without making it public.

Ensuring Secure Sharing of Confluence Pages with External Users: The miniOrange Approach


## From Authentication to Empowerment: Harnessing OAuth and OpenID Connect for Atlassian App Advancements {#harnessing-oauth-and-openid-connect-for-atlassian-appdvancements}


So, you're in the midst of migrating your company's applications to a Data Center, huh? Well, you're definitely not alone. As the end of Server support looms, many companies are jumping on the migration bandwagon. And one thing they're considering is implementing Single sign-on (SSO) for their applications.

&nbsp;

Why, you ask? Well, SSO offers a slew of benefits like enhanced security, improved usability, and lower IT costs. Sounds pretty appealing, right? But here's the thing: when you're making the move to a data center and have an OAuth/OIDC provider, you'll need to decide if the native OAuth/OpenID Connect (OIDC) SSO option is the way to go.

&nbsp;

Now, let's talk about Atlassian's native OAuth/OIDC SSO. It's a simple implementation, sure, but it requires manual work and falls short of the features needed by major enterprises. And here's another challenge: configuring SSO within a reasonable timeframe is no walk in the park. Plus, debugging authentication issues without the right expertise can be a real headache. How long can you afford to troubleshoot while your users are left unable to access Jira? Definitely not ideal, right?

&nbsp;&nbsp;

### Empowering Your Data Center Setup with miniOrange OAuth/OpenID Connect {#empowering-your-data-center-setup-with-miniOrange-oauth-openid-connect}


This is where miniOrange comes to the rescue! Our [OAuth/OpenID Connect SSO](https://marketplace.atlassian.com/search?query=OAuth%20miniOrange) solution for Atlassian Data Center is packed with a whole bunch of powerful features. With miniOrange, you can achieve seamless login across Atlassian applications like Jira, Confluence, Bitbucket, and Bamboo with your OAuth or OIDC provider. Say goodbye to repeatedly entering credentials for each app!

&nbsp;

So, if you're looking to supercharge your Atlassian Data Center setup and keep your system secure, adding advanced SSO features on top of Jira and Confluence's native SSO is a must. We've got your back. Ready to explore the world of hassle-free authentication? Let's dive in!

&nbsp;

### Enhanced Security with Single Logout/OIDC Logout {#enhanced-security-with-single-logout-oidc-logout}


Do you know how sometimes we forget to log out of all the applications we use? Well, that can make our Atlassian applications vulnerable to cyberattacks. But don't worry; with the OIDC logout endpoint, once you log out from one of your connected applications, all the other applications connected to the provider log out automatically.

&nbsp;

A best practice supported by the OIDC protocol is to close all your sessions centrally from just one application! and it's a great way to keep your accounts safe and secure. No more worrying about leaving sessions open in multiple places. It's a game-changer for security!

&nbsp;

### Manage User Permissions in Data Center {#manage-user-permissions-in-data-center}


Handling users and their permissions in Atlassian applications can be quite a challenge for administrators. Automated provisioning makes things easier, and with this feature, administrators can manage groups in the OAuth/OpenID Provider and then sync or provision them in SSO-connected Atlassian applications.

&nbsp;

Now, here's where miniOrange's SSO plugin goes a little beyond. It lets you pick whether you want to sync all groups or just specific ones from the OAuth/OpenID Provider, depending on what suits your needs best. You also have the flexibility to include local groups and set up a few important groups as Default groups. What's neat is that after a user logs in through Single sign-on, these assigned groups will automatically be configured for them. 

&nbsp;
### Connect With Multiple Identity Provider Eas {#connect-with-multiple-identity-provider-eas}


When it comes to Enterprise organizations using Data Centers, things can get pretty complex, especially with their identity infrastructure. They have a bunch of Identity providers, some of which even use custom OAuth providers. And guess what? Different branches and divisions might be using them all at the same time.

&nbsp;

But don't worry, we've got you covered with miniOrange OAuth/OIDC SSO, as you can easily add multiple identity providers and enjoy a seamless login experience. No more headaches, just smooth sailing!

&nbsp;


### A Safety Net With Emergency URL and Group Restriction {#a-safety-net-with-emergency-url-and-group-restriction}


A valuable feature that provides a safety net for your users in case of any issues with your identity provider. This feature enables access to Jira/Confluence's default login page, allowing users to bypass Single sign-on and use their local credentials in case of disruptions. Even if SSO is enforced for all users, the emergency URL empowers you to access the default login page effortlessly.

&nbsp;

And to add an extra layer of security, we offer Group Restriction functionality. By enabling Group Restriction, you can specify certain user groups that will have exclusive access to the Emergency URL and, subsequently, the default login page. With these powerful options, you can ensure smooth operations and enhanced security for your Jira/Confluence environment.

&nbsp;

### Reduce Setup Time & Avoid Misconfiguration {#reduce-setup-time-and-avoid-misconfiguration}

When testing your setup in the test environment, you can conveniently export the configuration and apply it to the production environment. By utilizing the exported data, administrators can avoid the need to reconfigure settings from scratch, significantly reducing setup time and minimizing the risk of critical system misconfigurations. This feature is exclusive to administrators.

&nbsp;

### OAuth Provider Specific Documentation

[miniOrange OAuth/OIDC SSO](https://miniorange.in/atlassian/jira-oauth-openid-single-sign-on-sso#setup-guide-section) documentation provides comprehensive, step-by-step instructions on configuring SSO to seamlessly connect with various Oauth providers. As each Identity Provider follows its own unique approach, our documentation caters to the specific requirements of each provider, ensuring a smooth integration process.

&nbsp;

### Ease of Customization - Tailor Login, Logout, and Error Templates with Ease:


Our platform allows seamless customization of Login, Logout, and Error Templates, empowering users worldwide to personalize their templates to suit their specific requirements. With ‘Enhanced Oversight with Audit/Debug Logs’ you gain comprehensive insights into the plugin’s functionality with detailed logs, identifying any errors or issues promptly.

&nbsp;

### There You Have It, Time For You to Take the Call...


In a nutshell, the [miniOrange OAuth/OIDC](https://miniorange.in/atlassian/jira-oauth-openid-single-sign-on-sso) plugin is your go-to powerhouse for ensuring top-notch security while granting access to your Atlassian Data Center apps, no matter where your users are operating from. 

&nbsp;

If you're curious about diving deeper into how this tool can seamlessly integrate into your existing resources, don't hesitate to get in touch with us at **atlassiansupport@xecurify.com**. Alternatively, you can simply click here and explore how our plugin can cater to your Single sign-on (SSO) needs. We're here to help you every step of the way, as we believe that simplicity is the key, removing friction is paramount, and rethinking security is critical.

&nbsp;

Contact Us – Drop us a mail at **info@xecurify.com** or [raise a ticket here](https://miniorange.atlassian.net/servicedesk/customer/portal/2) to talk to us.





Are you currently in the process of migrating your company's applications to a Data Center? If so, you're not alone. With the looming end of Server support, many companies are now opting to join the migration trend. Among the considerations gaining significant attention is the implementation of Single Sign-On (SSO) for their applications. Let's delve into the details of this crucial aspect and understand why SSO is becoming a central focus for improved user experiences in the Data Center era.

From Authentication to Empowerment: Harnessing OAuth and OpenID Connect for Atlassian App Advancements


## Fortify Your Defenses: Understand How Two-Factor Authentication (2FA) Works and Its Benefits {#fortify-your-defenses}

&nbsp;

In our previous exploration of Two-Factor Authentication (2FA), we introduced you to its significance and various types. Now, in this article, we're going to dive deeper into the mechanics of 2FA and uncover the numerous advantages it brings to the table.

&nbsp;

Recent breaches at casino giants [MGM Resorts International and Caesars Entertainment](https://www.reuters.com/technology/hackers-who-breached-casino-giants-mgm-caesars-also-hit-3-other-firms-okta-says-2023-09-19/), as reported by Reuters, serve as a stark reminder of the constant cyber threats we face. These high-profile hacks shine a spotlight on the pervasive issue of ransomware attacks, which plague countless companies, from healthcare providers to telecom firms.

&nbsp;

In a world where digital threats are ever-present, ‘Two-Factor Authentication’ (2FA) acts as your digital shield. Today, we'll discuss how it works and highlight its real-world benefits, making it an essential tool in our interconnected lives. [Let's explore 2FA](https://www.miniorange.in/atlassian/two-factor-authentication-for-atlassian/), its inner workings, and the peace of mind it provides in our evolving digital landscape. In the face of these cyber challenges, 2FA can be your starting point towards enhanced cybersecurity.



### How it Works {#how-it-works}

&nbsp;

Here's a fun way to understand the process of 2FA. Imagine you're about to enter a top-secret facility, but a simple key won't be enough to gain access. You need something more... something extra! That's where two-factor authentication (2FA) comes in, acting like a double lock to protect your digital fortress.

&nbsp;&nbsp;

Step 1: You approach the virtual gate, guarded by a sophisticated authentication system. It's like a digital bouncer checking credentials.

&nbsp;

Step 2: You confidently state your username and password, like whispering the secret passphrase to the gatekeeper. The first lock clicks open.

&nbsp;

Step 3: But wait! This is a high-security zone. The gatekeeper insists on an additional form of identification, like a secret agent demanding to see your special gadget.

&nbsp;

Step 4: In response, you whip out your digital keycard, which is unique to you. It could be a code sent to your mobile phone or a special app that generates time-limited codes. It's your secret agent gadget!

&nbsp;

Step 5: The gatekeeper examines your keycard, verifying its authenticity. It's like scanning your device for a special encrypted mark, ensuring you possess the right authorization.

&nbsp;

Step 6: Beep, boop, beep! The keycard beeps in approval, confirming that you're the real deal. The second lock disengages, granting you access to the inner sanctum.

&nbsp;

Voila! You've successfully accessed the fortified walls with the power of 2FA. But remember, this is just one thrilling example. Two-factor authentication can take various forms:

&nbsp;

It could involve receiving a secret code via text message or email, acting as a temporary password that changes each time. Perhaps you need to scan your unique fingerprint or use facial recognition as the second factor, like an undercover agent's biometric identification. Some situations may even require you to answer a set of personal questions, like revealing classified information only you would know.

&nbsp;

In essence, [2FA ](https://marketplace.atlassian.com/search?query=miniOrange%202FA)is like having an extra layer of security, ensuring that even if someone manages to crack your password, they'll still need that second factor to breach your defenses. It's a way to keep your digital assets locked up tighter than Fort Knox.

### Benefits of 2FA: Protecting Assets and Data {# benefits-of-2fa-protecting-assets-and-data}

In the age of relentless cyber threats, safeguarding your digital assets and data is paramount. Two-factor authentication (2FA) stands as a formidable ally in this battle, providing an additional layer of defense that can make all the difference. Let’s delve into the concrete benefits of 2FA.

&nbsp;

**Protects assets and data from password weaknesses**

&nbsp;

Passwords are often weak and easily guessed. This puts your accounts and data at risk. With 2FA, you add an extra layer of security beyond just a password. This makes it much harder for attackers to access your accounts even if they steal or guess your password. 2FA helps prevent breaches and other password-related cybercrimes.

&nbsp;

**Cost effective, prevents data breaches and streamlines operations**

&nbsp;

Data breaches can be very expensive. The average cost of a single breach has been increasing over the years. When breaches happen because of compromised passwords, the costs are even higher. By implementing 2FA, you can prevent breaches and save money. Additionally, 2FA reduces the number of password reset requests. This means fewer calls to the helpdesk and less money spent on resetting passwords.

&nbsp;

**Weakens phishing attacks**

&nbsp;

Phishing attacks are a common way for attackers to trick people into revealing their passwords. However, 2FA can help weaken these attacks. Even if someone falls for a phishing email and gives away their password, the attacker still needs the second authentication factor to access the account. For example, they would need a code sent to the user's phone. This extra layer of protection makes it harder for attackers to compromise your account through phishing.

&nbsp;

**Gives more time to address attacks**

&nbsp;

When an attacker gets hold of a password, they can quickly cause damage. But with 2FA, there's an extra barrier. Even if a user loses their second factor, like a mobile device, security teams have more time to respond before the attacker can do significant harm. This additional time allows for taking necessary actions to secure the account and investigate the breach.

&nbsp;

**Improves security in remote settings**

&nbsp;

With the rise of remote work, security challenges have increased. Many employees use insecure devices and networks, putting sensitive information at risk. 2FA addresses these concerns by providing secure access to company resources from any device and location. Employees can work remotely without compromising the company's security. This not only boosts productivity but also ensures data protection.

&nbsp;

**Meet customer expectations**

&nbsp;

Customers want their online accounts and data to be protected, especially for financial transactions. By offering 2FA, businesses meet customer expectations and gain trust. Users are more likely to choose a service that provides 2FA because they know their accounts are better protected. Implementing 2FA demonstrates a commitment to user security and helps organizations stand out in the market.

### In the end {#in-the-end}

&nbsp;

Having explored the benefits of 2FA and its importance in securing your digital assets, it's time to consider effective solutions that can further enhance your organization's security posture. [miniOrange](https://www.miniorange.in/) offers a range of advanced products and solutions designed to complement and strengthen your existing 2FA implementation.

&nbsp;

With our innovative features and cutting-edge technology, our products provide an added layer of protection, ensuring the highest level of security for your sensitive data and critical systems. Delve into the key features and advantages of our products and see how they can help take your organization's security to the next level.

&nbsp;&nbsp;

Reach us at **+1 978 658 9387** for a demo or email your queries to **info@xecurify.com**, we would be glad to take it forward from there.


Building upon the foundation laid by our initial exploration of Two-Factor Authentication (2FA), we take a deeper dive into the mechanics of 2FA. Here, we unveil additional layers of insight into the numerous advantages it brings to the table. If you've followed our previous discussion, get ready for a more detailed understanding of how 2FA enhances security.

Fortify Your Defenses: Understand How Two-Factor Authentication (2FA) Works and Its Benefits


## Simplifying Collaboration with OAuth SSO and SCIM {#how-atlassian-oauth-sso-and-scim-app-simplifies-user-management-and-collaboration}

Ever wondered how teams navigate the intricate landscape of digital collaboration and evolving workspaces? A team seamlessly orchestrating projects with tools like Jira and Confluence. But, as teams and projects grow, a new question arises: How do we simplify the authentication process without compromising security? To address the situation, the recommended approach is to incorporate the SCIM app with Atlassian OAuth Single Sign-On (SSO) for a more streamlined and effective solution.

&nbsp;

Jira excels as a project tracker, and Confluence plays a central role in collaborative content creation. User authentication across Atlassian products is crucial, and a robust Single Sign-On (SSO) solution becomes increasingly vital as these applications enhance productivity.

### Advancing Authentication: Atlassian OAuth SSO {#advancing-authentication}

Embracing the demand for streamlined and user-friendly authentication, Atlassian OAuth SSO emerges as a powerful evolution in secure access, eliminating the hassle of multiple passwords for users. As organizations navigate the complexities of growing teams and intricate projects, the shift to Atlassian OAuth SSO becomes a game-changer.

&nbsp;

However, for enhanced SSO and identity management, organizations turn to SCIM apps, either for Jira or Confluence – the transformative solution within the Atlassian ecosystem. Atlassian OAuth SSO ensures a streamlined login process, where users authenticate once through their identity provider (IdP) and gain secure access to Jira, and Confluence. However, the challenge lies in effective user provisioning and management.


### User Provisioning: The Missing Piece {#user-provisioning-the-missing-piece}

SCIM app transforms the puzzle of identity management into a work of art. It seamlessly integrates with Atlassian OAuth SSO, providing a unified solution for both authentication and user provisioning. Atlassian OAuth SSO brings the power of single sign-on, simplifying access for users across various Atlassian products. Meanwhile, SCIM app steps in as the missing piece, extending this simplicity to user provisioning, ensuring that user information is consistently accurate and up-to-date.

&nbsp;

This integration doesn't just stop at efficiency; it also fortifies security. By combining the robust authentication of Atlassian OAuth SSO with the seamless provisioning of SCIM, organizations can create a fortress of identity management. This not only safeguards against unauthorized access but also ensures that the right individuals have the right level of access at all times.

&nbsp;

Let's dive into how this dynamic duo, Atlassian OAuth SSO+SCIM App, can redefine your collaboration experience.


### Instant Gratification: Immediate User Provisioning {#instant-gratification-immediate-user-provisioning}

The concept of "Instant Gratification" within the context of SCIM app immediate user provisioning heralds a significant transformation in the landscape of user onboarding processes. In traditional systems, there exists a temporal gap between the moment a user is added to an identity provider and when they are granted access to specific applications, such as those provided by Atlassian.

&nbsp;

SCIM addresses this challenge by introducing a revolutionary approach that eliminates the delays associated with user provisioning. No more delays between adding a user to your identity provider and gaining access to Atlassian applications. This boosts efficiency, minimizes disruptions, and ensures that your team has instant access to the tools they need.

&nbsp;


### Dynamic Group Mapping: Effortless Synchronization {#dynamic-group-mapping-effortless-synchronization}

Mapping Identity Provider (IdP) groups to application groups with SCIM, streamlines user group and permission management. This enables automatic assignment and updates of user groups and permissions based on changes in IdP groups. For instance, if a user belongs to the administrators group on IdP, admin permissions can be assigned through mapping. If the user is later removed from the administrators group on IdP, they will be automatically removed from the application admin group.

&nbsp;

The mapping process provides two distinctive approaches: **Manual Group Mapping and On-The-Fly Group Mapping**. Manual Group Mapping is the preferred choice when there is a disparity between IdP group names and local application group names, necessitating the manual association of each IdP group with its counterpart in the application. On-the-Fly Group Mapping, on the other hand, is advantageous when IdP group names precisely match local application group names.

&nbsp;


### Syncing User Status with Ease {#syncing-user-status-with-ease}

While Atlassian OAuth SSO provides a robust single sign-on solution, ensuring synchronized user statuses poses a considerable challenge. In response, SCIM app emerges as the essential tool for seamlessly managing user status changes throughout your Atlassian suite, encompassing Jira and Confluence.

&nbsp;

When a user departs from an organization, SCIM app promptly deactivates their accounts across all integrated platforms. This proactive measure not only enhances security by swiftly revoking access but also simplifies the intricate process of user management. SCIM's synchronization capabilities extend beyond mere deactivation; it enables real-time updates, promptly reflecting changes in user roles and permissions across Atlassian applications. This not only ensures enhanced security but also contributes to cost savings by efficiently managing licenses through timely deactivation.

&nbsp;

### Tailored User Identities: Modify Group and Usernames {#tailored-user-identities-modify-group-and-usernames}

SCIM app allows you to modify groups and usernames with special rules. By implementing customized rules for groups and usernames, organizations can not only achieve uniformity but also bolster their security posture. Moreover, our SCIM app  provides the ability to transform usernames systematically, ensuring that they adhere to your organization's standards.

&nbsp;

This not only promotes clarity but also aids in preventing potential security vulnerabilities associated with inconsistent or non-compliant usernames. Consistent and well-structured user identities across applications contribute to a more efficient and secure identity management system, ultimately enhancing the overall cybersecurity framework of your organization.

&nbsp;

### Attributes Redefined: Mapping and Customization {#attributes-redefined-mapping-and-customization}

Attribute mapping involves associating specific user details. By mapping key attributes like username, email, mobile number, and display name to your identity provider, you ensure precise user profiles, fostering a seamless environment across Atlassian applications. This process guarantees consistency and accuracy in user profiles across various platforms.

&nbsp;

It enables organizations to synchronize and uphold uniform information, promoting seamless data exchange and enhancing overall system interoperability. Attribute mapping and customization not only boost accuracy but also contribute to a more personalized and efficient user experience.

&nbsp;

### Embrace the Power: Atlassian OAuth SSO+SCIM App {#embrace-the-power-atlassian-oauth-sso-scim-app}

In a nutshell, Atlassian OAuth SSO+SCIM app is your ticket to streamlined user management and heightened security. While OAuth SSO ensures secure authentication, SCIM takes user provisioning and management to the next level. With immediate provisioning, automated group mapping, and real-time updates, organizations can elevate their security, compliance, and user experience across Atlassian's collaborative tools.

&nbsp;

Don't wait! Embrace the power of Atlassian OAuth SSO+SCIM App today. Experience a compelling solution that makes managing users in Atlassian's collaborative tools easier than ever. For a demo, reach us at **+1 978 658 9387**or email your queries to **support-atlassian@miniorange.atlassian.net**. We're eager to hear from you.



The Atlassian OAuth SSO+SCIM DC combination is not just a solution; it's an invitation to elevate your collaboration effortlessly. In this article, let’s go on a journey into the dynamics of Atlassian OAuth SSO paired with SCIM DC. A powerful integration that redefines user authentication, provisioning, and management across Jira and Crowd. Uncover the seamless synergy of this transformative duo as it elevates the overall user experience.

How Atlassian OAuth SSO and SCIM App Simplifies User Management and Collaboration


## How miniOrange SCIM Simplifies Centralized IDP User Management in Atlassian Apps

If your business relies on various Atlassian applications and services to conduct your day-to-day operations, you would certainly relate that managing user accounts and their access could be challenging and often time consuming. This is where **miniOrange’s User Sync/SCIM** App comes into play.

SCIM an acronym for ‘System for Cross-domain Identity Management’ is a protocol that allows for automated provisioning and de-provisioning of user accounts between different systems. Our app allows seamless login into the **Jira, Confluence. Bitbucket, Crowd** and other Atlassian applications with Identity Provider (IdPs) like [Azure Active Directory, Keycloak, Okta, OneLogin, Oracle and more.](https://developers.miniorange.in/docs/atlassian/scim/overview)

To get a better understanding of its use cases, let’s take Okta as the identity provider and an application, say Jira:

### New Employee Onboarding (User Creation) {#user-creation}

When we talk about user creation, we refer to the process of adding a new user account to various systems that they may require. This usually happens when a new employee joins an organization and would need access to, say for instance, a team collaboration tool (Confluence) or a project management tool (Jira), if a developer then probably a tool to effectively store, manage and monitor codes (Bitbucket).

Let’s say when a new employee joins your company, the IT administrator with user information like username, email, and other relevant details would create a new user account in Okta (IDP), and then miniOrange User Sync/ SCIM ensures that accounts created in Okta is automatically replicated in Jira, profiles and attributes are in sync between both the systems.

### Change in User Information (User Updation) {#user-updation}

User information like email address, phone number, or role may change over time, and it’s essential to keep this information updated and ensure that it is consistent in all applications. Any such changes can also be automatically updated using miniOrange User Sync/ SCIM. Admins can easily update user information in Okta and those changes would reflect in Jira.

For example, if a user changes their phone number, you can update that information in Okta and the changes would be synced in Jira so that it’s consistent with both systems.

### Revoking User Access (Deactivation) {#user-deactivation}

When an employee leaves the company their access to company resources should be removed to maintain security and compliance. It also could be the case that a user’s access to certain systems needs to be revoked based on role change. This process of deactivation is automated just like the above with the app and once a user is deactivated in Okta, SCIM App will automatically deactivate the corresponding user in Jira.

For example: if an employee leaves the company, the HR department would disable their account in Okta and the miniOrange User Sync/SCIM would then automatically disable or remove the user’s account in Jira so that their access to the application is revoked.

### Assigning Groups to Users (Group Mapping) {#assigning-groups-to-users}

![SCIM flow diagram](/blog/assets/2023/miniorange-scim-for-atlassian-apps.webp)

Another essential use case is that it enables admins to manage user access to different resources and applications based on their group, in other words, it refers to the process of associating users with specific groups. With miniOrange User Sync/SCIM, you can map users to groups in Okta and Jira. This ensures that users have the necessary access to resources based on their roles and responsibilities. Group mapping can be done manually or [on the fly](https://developers.miniorange.in/docs/atlassian/scim/user-groups).

**Manual Group Mapping** involves manually assigning users to groups in Okta and Jira. It is useful when your IdP group names and local application group names are different here you would have to map each IdP group to the application group manually.

It allows you to manually map Jira groups with the groups from Okta or filter groups, and make changes to existing users. Manual Group Mapping is useful when you want to manage groups from Okta but the group name differs in Okta and Jira.

For example, if the name of the group in Okta is Dev users but the name of a similar group in Jira is Software_dev. In such scenarios, you would have to manually map each Okta group to the Jira group.

**On-the-fly** group mapping refers to the process of dynamically mapping users to groups. For instance, when group names in Okta and Jira are an exact match, the app would detect the groups and add users to those groups automatically and if a group doesn’t exist in Jira then it would be created.

Let’s say for better clarity, you use Okta for identity and access management and Jira for project management. There are several teams working on different projects, each team has its own group with a unique name, here let us consider “Marketing” group in Okta and a “Marketing” group in Jira. When a new user joins the company, they are added to Okta, and their profile contains information about which team they belong to.

As there is an integration between Okta and Jira using the miniOrange app that supports on-the-fly group mapping. The app detects the team information from Okta and checks if a group with the same name exists in Jira. If a group with the same name exists, the user is automatically added to that group, in this case, “marketing” if not, then a new group ‘marketing’ is created in Jira and the users are added.

The above are just a few of the most common use cases but it’s not just limited to that. **Identity Migration**-moving from one IdP to another, **SSO (Single Sign-On)** can be integrated with our SCIM app, **attribute transfer** to a relying party’s website and more. That brings us to…

### How Do IT Administrators Working with Atlassian Applications Benefit? {#benefits-for-it-admins}

Our SCIM integration offers various benefits to Atlassian application users, be it **Confluence, Jira, Bitbucket, or Crowd.** It is a popular solution among IT admins for user provisioning and de-provisioning. One of the main advantages of SCIM is that it **saves licensing costs** as it automates the user provisioning and de-provisioning process. Organizations with a large number of users can reduce the number of licenses needed for applications thus saving a significant amount of money.

The addon ensures that resources are allocated more efficiently as new users are automatically provisioned with the appropriate access rights. miniOrange User Sync/SCIM allows for **granular control** so that users only have access to the resources they need thus **mitigating the risk of unauthorized access.** All leads to **enhanced security** by ensuring that user access is granted or revoked in a timely manner.

Companies can expect an **increase in productivity** as our app eliminates the need for manual user provisioning and de-provisioning so that your IT staff can focus on more critical tasks. The automated process **reduces the risk of manual errors** as well. With these benefits, your business can look to **improve the overall user experience** eventually leading to higher user satisfaction.

### Summary {#summary}

If you are here, that means you took the time to go through the use cases and the overview of our app. No more time-consuming manual onboarding and offboarding users, employees get easy and quick access to the apps they need to work. You get automated access management that not just saves you time but also money.

You could also go through our other apps that compliment ‘lifecycle management’ such as SSO that would work in tandem to keep you secure. So, set up your employees fast with what they need, and unburden your IT team to focus on the bigger picture. Looking for something specific? Please contact us at **support-atlassian@miniorange.atlassian.net** or raise a support ticket [here](https://miniorange.atlassian.net/servicedesk/customer/portal/2), and keep watching this space for more new and innovative solutions.


SCIM an acronym for ‘System for Cross-domain Identity Management’ is a protocol that allows for automated provisioning and de-provisioning of user accounts between different systems. Our app allows seamless login into the Jira, Confluence, Bitbucket, Crowd and other Atlassian.

How miniOrange SCIM Simplifies Centralized IDP User Management in Atlassian Apps


## How miniOrange User Sync/SCIM Automates User Provisioning for Atlassian DC applications {#how-miniorange-user-sync-automates-user-provisioning-for-atlassian-dc-applications}

Managing users in Atlassian manually, especially in situations with large numbers of users, is time-consuming and prone to human error. With employees joining various departments and projects on a regular basis, a lot of time is spent on managing users with the access they need which can lead to users being provisioned incorrectly.

[miniOrange User Provisioning](https://marketplace.atlassian.com/search?query=miniOrange%20User%20Sync) for Atlassian applications comes packed with a variety of powerful features. With the miniOrange User Provisioning app, employee/user accounts can be created, updated, deleted, and given proper access across multiple applications at the same time. The procedure of adding, updating, and deleting users, as well as managing their access, is automated. 

&nbsp;

![user-sync-scim](/blog/assets/2023/user-sync-scim-automate.webp)


When it comes to Atlassian products such as Jira, Confluence, and Bitbucket you can use Just-in-time provisioning provided with the Single Sign-On functionality of Atlassian Data Center. The native SSO functionality of Atlassian allows you to update the users and their groups at the time of SSO login. **However, for most enterprises, this does not fulfill the overall requirement.** 

Atlassian SSO updates users and groups only at the time of SSO (Just in Time Provisioning). 

&nbsp;
 

Most Atlassian customers implementing SAML use the attributes sent in the SAML response to provision users just-in-time. 

 &nbsp;

Using Just In Time (JIT) Provisioning, you receive all group and user information from your Identity Provider. JIT provisioning will remove any existing Jira or Confluence groups that are not in the SSO response. Managing a few groups within Jira or Confluence will never work in this scenario. **If you are manually managing some groups, that will not work with Atlassian SSO. This is one of the shortcomings of Atlassian’s provisioning model and may not be an ideal solution for Enterprises.**

&nbsp;

In this article, we will go over the top provisioning features that you won’t find in Atlassian’s inbuilt User Provisioning in Data Center – but you will find in miniOrange’s User Provisioning App. 

&nbsp;

Let’s see what the miniOrange User Provisioning app offers along with Just-in-time provisioning:
 
- **Real-time provisioning**– your user and group information will get automatically updated every time the user’s data is updated in the Identity Provider. 

- **Sync the User from a particular group or an application** – You can sync users from a particular group or application if you do not want all your users synchronized. Members from only that group will be synchronized. 

- **User Deactivation/Delete from Jira/Confluence** - According to some estimates, approximately 30% of all Atlassian user licenses are unused. This happens because users that leave the organization or change roles don’t have their accounts deactivated in a timely manner. Atlassian users whose accounts haven’t been deactivated can have negative consequences, like exceeding license limits leading to an increase in licensing costs and retaining access from former employees – posing major security concerns.

&nbsp;&nbsp;

**Just-in-Time provisioning cannot be used to deactivate the user since the SSO process involves active user accounts.** You can manually remove the user from the Jira group but it will still consume the licenses. 

With the help of our User Provisioning Add-on, you can **automatically deactivate and delete multiple users** from specific groups. Users can be automatically deleted based on their status in the directory. 

- **Synchronization of User Directories:** the miniOrange User Sync plugin can synchronize entire directories with the help of Real-time provisioning. When user directories are synchronized, new users will automatically be added in the respective Atlassian applications. With User Directory Synchronization you can also sync IDP-specific directories. You can also schedule synchronization which provides proactive provisioning and de-provisioning of users and groups at regular intervals (sync).

- **User name and Group transformation –** Native SSO provisioning requires you to provision the user with the same username as IDP. However, with username transformations, you can associate the provisioning of users with different values. Filtering groups will help you to manage access and permissions within Jira or Confluence easily.

Apart from this, the [miniOrange User Provisioning](https://marketplace.atlassian.com/search?query=miniOrange%20User%20Sync) App offers a wide range of features focusing on provisioning users from your IDP directory into Atlassian Applications. Below is the detailed comparison of the [miniOrange User Provisioning app](https://marketplace.atlassian.com/search?query=miniOrange%20User%20Sync) with native Atlassian. 

### miniOrange User provisioning Features {#miniorange-user-provisioning-features}

1. Supports SCIM 2.0 and SCIM 1.1 protocol	
2. On- the fly group mapping
3. Manual Group Mapping	
4. Default Group Mapping
5. Sync History
6. Provision to map groups from IdP to local groups

**Ready for the action? Install User Sync today!**

 &nbsp;&nbsp;

It’s really easy to manage users via our developed user provisioning add-ons which can be connected with your IDPs ([Azure AD](https://www.miniorange.in/atlassian/jira-scim-user-and-group-provisioning-for-azure-ad), [Okta](https://www.miniorange.in/atlassian/jira-scim-user-and-group-provisioning-for-okta), [OneLogin](https://www.miniorange.in/atlassian/jira-scim-user-and-group-provisioning-for-onelogin), [G suite](https://www.miniorange.in/atlassian/user-and-group-sync-user-provisioning-g-suite/), [Keycloak](https://www.miniorange.in/atlassian/user-and-group-sync-for-keycloak)) or any other SCIM compliance applications so when you setup your Jira Azure AD SCIM or Jira Okta SCIM, user sync plugin will make it a cakewalk for you. Follow the guide to quickly set it up for the Data Center version.

 &nbsp;&nbsp;
 
The add-on also works with [Single Sign On](https://marketplace.atlassian.com/search?query=miniOrange%20Single%20Sign%20On%20) where SSO is used for authentication and User sync application is used for automatic provisioning.


&nbsp;&nbsp;


Contact Us – Drop us a mail at **info@xecurify.com** or [raise a ticket here](https://miniorange.atlassian.net/servicedesk/customer/portal/2) to talk to us.





Managing users in Atlassian manually, especially in situations with large numbers of users, is time-consuming and prone to human error. With employees joining various departments and projects on a regular basis, a lot of time is spent on managing users with the access they need which can lead to users being provisioned incorrectly.

How miniOrange User Sync/SCIM Automates User Provisioning for Atlassian DC applications


## How to Eliminate Unused JSM Agent Licenses and Save Thousands Annually {#eliminate-unused-jsm-agent-licenses}

Managing licenses for Jira Service Management (JSM) can be a tricky and costly endeavor, particularly when agent licenses go unused. Often, businesses invest heavily in these licenses, only to find that many of them remain inactive. The result is an unnecessary expense that could be better allocated elsewhere.

Fortunately, you can cut down on these expenses by regularly auditing your JSM agent licenses and taking steps to remove inactive users. 

Let’s dive into how miniOrange can help you curb these unnecessary expenses by effectively managing unused agent licenses in JSM.
 


### Understanding the Cost of Unused JSM Agent Licenses {#cost-of-unused-jsm-agent-licenses}

Imagine you’ve purchased 30 agent licenses but only 25 are actively being used. The remaining five licenses represent a portion of your budget that is essentially being wasted. Over time, this can accumulate into significant and unnecessary costs.

If this is happening in your organization, it’s time to address the issue and reclaim those wasted resources.



### The Real-World Impact: How Unused Licenses Inflate Your Budget {#the-real-world-impact}

Let’s take a look at the numbers to better understand the financial impact.


1. **Standard Plan Example:**

    - **Scenario**: You have 30 agent licenses but only 25 agents actively using them.
    - **Cost for 30 agents**: ~$9,100 annually.
    - **Cost for 25 agents**: ~$4,900 annually.
    - **Savings**: $4,200 annually.
 
By simply revoking access for the five inactive agents, you can reduce your annual cost by a substantial $4,200.


2. **Premium Plan Example:**

    - **Scenario**: You have 70 agent licenses but only 50 agents actively using them.
    - **Cost for 70 agents**: ~$44,000 annually.
    - **Cost for 50 agents**: ~$22,500 annually.
    - **Savings**: $21,500 annually.


In this case, removing the access for 20 inactive agents can lead to savings of over $21,500 annually. 

In larger organizations, the financial impact is even more profound. For companies managing a vast number of JSM agent licenses, reclaiming these costs can lead to significant long-term benefits.


### The Solution: Remove Inactive Agents {#remove-inactive-agents}

Many organizations make the mistake of assigning licenses to users without performing periodic audits to assess if they are still necessary.

By identifying and deactivating agents who haven’t used their JSM license for a specified period—say, the past 30 or 60 days—you can recover these unused licenses and assign them to active users as needed. 

A great thing about this approach is that removing JSM agent access doesn’t interfere with a user's overall Jira license. This ensures you're focusing solely on cutting unnecessary JSM costs without disrupting their Jira access.


### Automating License Management: Bulk User Management for JSM {#bulk-user-management-for-jsm}

Manual audits can be tedious and prone to oversight, but there are tools that can streamline this process. 

One such tool is the miniOrange Bulk User Management application. 

This tool allows you to automatically identify and remove inactive JSM agent licenses, offering a simple and efficient two-step process:

&nbsp;

1. **Identify Inactive Agents**: Using a built-in scheduler, the app runs daily checks to identify agents who haven’t logged into JSM for a predefined period.

&nbsp;

2. **Remove JSM Agent Access**: Once identified, the app automatically removes agent access for inactive users while keeping their regular Jira user licenses intact.

With this automation in place, you ensure that your JSM agent licenses are always optimized without the need for manual intervention. Additionally, the freed licenses can be reassigned to other users as your business needs evolve, ensuring you’re always paying for the exact number of agents you need.


### Benefits of Optimizing Atlassian Jira Service Management Licenses {#benifits-of-optimizing-jsm-licenses}

By regularly auditing and managing your JSM agent licenses, you can achieve several key benefits:
    
- **Cost Efficiency**: Only paying for the licenses your agents actively use translates to significant savings.
- **Improved Resource Allocation**: Funds saved on unused licenses can be redirected toward more pressing business needs, such as software upgrades, employee training, or expansion projects.
- **Scalability**: By automating the management of your agent licenses, your business can scale efficiently without worrying about spiraling costs due to inactive users.

### Conclusion {#conclusion}

Overpaying for unused JSM agent licenses can place an unnecessary burden on your business, but it doesn’t have to be that way. By taking a proactive approach and utilizing tools like miniOrange’s Bulk User Management application, you can reclaim unused licenses and optimize your costs effectively.

You can start saving today by auditing your JSM agent licenses and enjoying the financial benefits of a more streamlined, cost-effective licensing strategy.

For a hands-on demo of the miniOrange Bulk User Management application or to get started, reach out to us at [mahima@xecurify.com](mahima@xecurify.com) or [info@xecurify.com](info@xecurify.com).




Stop overpaying for unused Jira Service Management (JSM) agent licenses. Explore effective strategies for auditing and reclaiming costs while optimizing your licensing with miniOrange’s Bulk User Management, ensuring you pay only for active users.

Stop Overpaying: How to Eliminate Unused JSM Agent Licenses and Save Thousands Annually


## How to secure Atlassian Cloud Applications ?

**“Arguing that you don’t care about the right to privacy because you have nothing to hide is no different than saying you don’t care about free speech because you have nothing to say.”**
**– Edward Snowden**

Atlassian’s announcement that it would be shutting down its server instances had a significant impact on the customers. Confusion grew among people as some chose Atlassian’s Data Center while others chose Atlassian Cloud. Both Data Center and Cloud have their own set of benefits and drawbacks. Given that Atlassian itself faced a cyber attack, one of the most common questions was, “Is Atlassian Cloud secure in terms of cyber threats?”..

Products made by Atlassian are high quality, very secure, and reliable. But as they say, there is always scope for improvement. This article will mainly focus on how we can make Atlassian Cloud applications more secure, avoid cyber-attacks, and ensure vulnerability management.

When we talk about securing an application for thousands of users, adding an extra layer of authentication on top of the basic authentication can prove to be extremely helpful in ensuring security. With 2 layers of authentication, hacking into any system becomes more difficult. Hence, there is an increase in demand for authentication methods such as Single Sign-On (SSO), Two Factor Authentication (2FA), and Multi-factor Authentication (MFA) in the last couple of years.

Atlassian provides an additional level of security by allowing users to Single Sign-On. Single Sign-On (SSO) and Two Factor Authentication (2FA) go hand in hand so it won’t be an issue for customers who are using the in-built SSO solution for Atlassian Cloud.

Let’s understand what Single Sign-On (SSO), Two-Factor Authentication (2FA) or Multi-Factor Authentication (MFA) are and how they are used to secure Atlassian cloud applications.

### Single Sign-On (SSO) {#single-sign-on}

Single Sign-On (SSO) is an authentication process in which a user is authenticated against the Identity Provider which is connected to the Atlassian Applications. These users authenticate using XML assertion in SSO. This reduces security threats and protects user data.

Atlassian has an inbuilt connector for Single Sign On (SSO) which works well for SAML Identity Providers and it is highly recommended to solve complex use-cases like login with multiple IDPs and managing user permissions.

With the miniOrange Atlassian SAML/OAuth Single Sign-On (SSO) plug-in, you can perform seamless login into your Atlassian applications.

### Two Factor Authentication (2FA) {#two-factor-authentication}

Two-factor authentication (2FA), sometimes referred to as two-step verification, is a security process in which users provide two different authentication factors to verify themselves on top of the username and password authentication. This process is done to better protect both the user’s credentials and the resources the user wants to access, which in our case is the respective Atlassian Cloud.

### Multi-Factor Authentication (MFA) {#multi-factor-authentication}

Multi-Factor Authentication (MFA) is an authentication process in which a user has to provide multiple factors of authentications in order to gain access to Atlassian cloud. Rather than just asking for a username and password, Multi-Factor authentication adds additional verification factors such as OTP, push notifications and biometrics that help in adding an extra layer of security to your Atlassian application.

The above explanation was fairly technical so let’s understand this with the help of an example.

Let’s consider an example where you want to make an online transaction. You use credentials to protect your account from unauthorized access. While making a payment, you have to verify the credentials. This acts as the first line of defence. But there is still room for a hacker to gain access to your banking details compromising your security. So, another layer of authentication is added in the form of an ATM pin or OTP over SMS or email. This serves as the second security measure. Only after both steps does your payment go through.

Similarly, here your Atlassian applications like JIRA, confluence and Bitbucket contain confidential information associated with your account and your organization. This content can be protected using our plugins. Not only will our plugin add an extra layer of security, but it will also ensure that the usability and login experience of the users is not compromised upon.

Since the cloud community is still growing, applications that support 2FA over Atlassian cloud are very few. miniOrange can help in fulfilling the needs of Single Sign-On (SSO) as well as Two-Factor Authentication (2FA). The Two-Factor Authentication solution provided by miniOrange over Atlassian cloud contains many authentication methods such as OTP over SMS, OTP Over Email, Hardware Token, Authenticator token, and many more. Our Plug-ins have the capacity to manage a huge number of users. With miniOrange, external and internal users can be managed in one place. It can easily be integrated with external AD/LDAP directories or other Identity Providers (IDPs) without any hassle. Your Atlassian users can use the same credentials and Two-Factor Authentication to access multiple applications.

We have a Two Factor Authentication (2FA) solution for Atlassian Server and Data Center as well. Give a quick read to this [Article](https://community.atlassian.com/t5/Marketplace-Apps-Integrations/Best-way-to-Secure-Your-Atlassian-Data-Center-DC/ba-p/1687486#M4645).

For detailed information about our SSO and Two-Factor Authentication add-ons please refer to the [link](https://www.miniorange.in/atlassian). In case of any queries, please feel free to drop us a mail at [info@xecurify.com](mailto:info@xecurify.com)


Secure Atlassian cloud Apps like Jira & Confluence cloud using miniOrange SSO solution with additional security of Two-Factor Authentication(2FA /MFA)

Secure Atlassian Cloud with Single Sign-On (SSO) & 2FA/MFA


## Jira Cloud SCIM/User Sync: Embrace Multiple IDPs and Customer Sync Freedom for Individual Applications {#jira-cloud-scim-user-sync}

&nbsp;

Is your business facing the challenge of synchronizing customer data along with integrating multiple identity providers (IDPs) for sync? Atlassian users look no further than our user management plugin [‘Jira Cloud SCIM/User Sync’](https://marketplace.atlassian.com/apps/1222000/mo-scim-provisioning-user-sync-group-sync-for-jira?hosting=cloud&tab=overview) which redefines the process, while seamlessly managing user identities and data synchronization.

&nbsp;

Let’s delve into the features of this groundbreaking plugin and see how it empowers enterprises to overcome the tedious task of synchronizing users/groups from multiple IDPs and streamlining customer data across multiple platforms.

&nbsp;&nbsp;

### Seamless Integration with Any IDP {#seamless-integration-with-any-idp}

&nbsp;

We begin with one of the key features, its ability to seamlessly integrate with any identity provider for synchronizing users. Whether your business relies on popular providers like Okta, Azure, or miniOrange, or you have a custom-built IDP, this plugin eliminates the hassle of performing different CRUD and User provisioning operations based on systems. It provides a unified interface for user provisioning, enabling developers to focus on building innovative applications rather than worrying about IDP compatibility.

&nbsp;

For instance, if an organization has customer identities managed in multiple Azure directories or in different entities like Okta and Azure AD, it would be a headache to manage these Identities at the same time on the Enterprise level. However, you can leverage our plugin to consolidate your user provisioning process and utilize both Azure and Okta simultaneously without having to choose one over the other and provide a seamless user experience across multiple applications..

&nbsp;&nbsp;


### Independent Application Development {#independent-application-development}

In the past, managing multiple users and groups manually has been a complex and time-consuming task. However, our plugin offers a solution that allows businesses to develop applications that are not limited to a single IDP or a specific method of customer and user synchronization. It provides flexibility and independence in integrating with different systems..

&nbsp;

For example, multiple SCIM connections (System for Cross-domain Identity Management to System for Cross-domain Identity Management): In this scenario, our plugin enables an application to synchronize user data between two or more IDPs that support the SCIM protocol. The application can retrieve user information from one SCIM-based IDP and synchronize it with another SCIM-based IDP.

&nbsp;

Likewise, you can create multiple connections for the SCIM or the REST API Connectors or a combination of both, while maintaining a unified user experience across different platforms.

### Flexible Customer Sync Options {#flexible-customer-sync-options}

When businesses use multiple applications, it's important for them to keep their customer data synchronized, meaning that the data is consistent and up-to-date across all the applications they use. Our plugin for JIRA makes it easy to manage this synchronization process. It gives you a lot of flexibility and customization options. You can decide how you want the synchronization to happen.


&nbsp;

For example, you can choose to sync the data in real-time, meaning it happens instantly as changes are made. Alternatively, you can do a group sync, where the data is synchronized in groups at specific intervals, control access to portals based on IDP groups and organizations. You can even choose to manually sync the data when you want. This flexibility ensures that your customer data stays current in all your applications, without affecting performance or the experience of your users.

### Enhanced Security and Privacy {#enhanced-security-and-privacy}

When we deal with user identities and sensitive customer data, our top priority is to ensure security and privacy. Our plugin is designed to ensure that the right people have appropriate access to your system. By implementing granular access levels, we provide a robust user management solution that allows you to assign and control permissions with precision.

&nbsp;

Administrators are empowered with comprehensive control, while users can perform advanced tasks within predefined boundaries. You can confidently regulate access and safeguard sensitive resources, ensuring that only authorized individuals can interact with them.

&nbsp;

By implementing these measures, we aim to maintain the highest level of security for user data throughout the entire process.

### Wrapping It Up {#wrapping-it-up}

With seamless IDP integration, Jira Cloud SCIM/User Sync offers a powerful solution for organizations seeking to enhance their user management capabilities. By integrating with your Identity Provider (IDP), it streamlines the user provisioning and management processes, ensuring a seamless experience for both administrators and end-users.

&nbsp;
By leveraging the SCIM functionality to Jira cloud, you can focus on delivering exceptional user experiences. With streamlined user management processes, you can devote more time and resources to building engaging applications and features that delight users. Our solution puts you in control by seamlessly integrating with multiple IDPs and facilitating customer sync, allowing you to maintain governance over your applications and data.

&nbsp;

To learn more about [Jira Cloud SCIM/User Sync](https://marketplace.atlassian.com/apps/1222000/mo-scim-provisioning-user-sync-group-sync-for-jira?hosting=cloud&tab=overview) or if you have specific inquiries, you can contact us at **support-atlassian@miniorange.atlassian.net** or raise a support ticket [here](https://miniorange.atlassian.net/servicedesk/customer/portal/2). Stay tuned to this space for more new and innovative solutions as we continue to enhance our offerings and deliver cutting-edge solutions to meet your evolving needs.


Contact Us – Drop us a mail at **info@xecurify.com** or [raise a ticket here](https://miniorange.atlassian.net/servicedesk/customer/portal/2) to talk to us.





Unlock exceptional user experiences while maintaining control over applications and data with Jira Cloud SCIM/User Sync. Seamlessly integrate your Identity Provider, develop custom applications, sync customer data, and enjoy enhanced security measures.

Jira Cloud SCIM/User Sync: Embrace Multiple IDPs and Customer Sync Freedom for Individual Applications


## Save Your Budget By Sharing Confluence Space & Pages With Unlicensed Users! 💸💰

[Confluence](https://www.atlassian.com/software/confluence?&aceid=&adposition=&adgroup=140527013959&campaign=18336813584&creative=621772822756&device=c&keyword=confluence&matchtype=e&network=g&placement=&ds_kids=p73000477014&ds_e=GOOGLE&ds_eid=700000001542923&ds_e1=GOOGLE&gclid=CjwKCAiAv9ucBhBXEiwA6N8nYNiC34mjJIjDGHonQsqo2gxQlIdb7W2xG1bTDOSFLPcKWYTBUpjPvhoCcS8QAvD_BwE&gclsrc=aw.ds) is the most used **team workspace** tool for collaboration.With real-time content, this dynamic tool makes it easier for the team to communicate effectively. You would typically wish to share the Confluence pages with two sorts of users: Licensed Users and External Users. **Licensed users** are mostly those who work for your company and regularly access Confluence; you **purchased** their Confluence **licenses** from Atlassian. On the other hand, **External users** or **Unlicensed users** don’t have direct access to your Confluence, they can be **freelancers** or maybe the **contractors** that you outsource for a specific project from some other company that you are collaborating with. External users can also be inside the company like people from Sales, Marketing, Support, Legal team or even an intern who don’t have access to your Confluence instance.

Ouchh that’s a problem! What can you do about it?

-   **Spend the project budget** on a license for each and every user in order to provide access to the material.

-   Sharing Confluence pages by **email** in the form of **PDF** or **Word** documents takes a lot of **time**, and what if someone makes significant changes after that? External users won’t have access to the most recent version of that page, leading to confusion and inefficiency.

Well, we don’t want you to spend too much time or money trying to solve these problems.

Introducing an add-on, [Secure Share Pages for Confluence Cloud](https://marketplace.atlassian.com/apps/1225078/mo-secure-share-pages-for-confluence-external-share?hosting=cloud&tab=overview) that can help you replicate and **share live Confluence** spaces and pages with **unlicensed users** or **external users** while maintaining the highest level of **security**. It allows the external users to view the space and add attachments like file or images to the Confluence.

**Comments** are the easiest way to start a discussion or conversation among the team members expressing your opinion or thought. There are two types of comments in Confluence:

**Page Comment –** This feature enables users to comment on the page’s whole content.

**Inline Comment –** The user can add a comment to a particular word, paragraph or section of the page.

miniOrange’s [Confluence Secure Share](https://marketplace.atlassian.com/apps/1225078/mo-secure-share-pages-for-confluence-external-share?hosting=cloud&tab=overview) for Cloud add-on allows **external users** to add both comments as well as inline comments.

Now that we’ve got that out of the way, how does this solution **work** and how secure is it?

With the Confluence **Secure Share** add-on, you can generate **secure, unique links** of the Confluence pages and share them with anybody you choose. An **additional layer** of security can be added by setting the **password to secure the links so that only **authorized external users\*\* can access them.

Obviously you don’t want your **link to revolve** in the universe **forever** and which is why there is a provision to set the shared link’s **expiration date,** after which the link becomes inactive and invalid.

Let’s explore the capabilities that the Confluence Secure Share add-on offers:

-   Create & share access links for any **Confluence** space & page.

-   Set **permissions** for external users to View **spaces & pages,** Add **comments & inline comments** and Add **attachments** in the shared pages.

-   You can create a **random password** or use your **own** to password-protect your shared link for **increased security**.

-   Set **validity** for the shared link

-   **Deactivate** the shared link as per your convenience

-   **Hassle-free deletion** for expired secure links

-   Free support for app setup. [Contact us](https://miniorange.atlassian.net/servicedesk/customer/portal/2) for a Secure Share demo!

We’re adding more **intriguing** and **useful features** to our add-on, like:

-   Receive updates about changes by subscribing to a Confluence space or page

-   Share child pages based on the labels

-   Restricting Confluence spaces based on the user roles or groups

-   Admin can have full control over the plugin and define the level of permissions for users


Secure Share Pages for Confluence Cloud that helps replicate and share live Confluence spaces and pages with unlicensed or external users

Sharing Confluence Space & Pages With Unlicensed Users!


## Secure Jira Datacenter With Password Policy Manager {#secure-jira-datacenter-with-password-policy-manager}

**Password security** is very important in today’s digital world. Atlassian allows you to create a secure environment by letting admins set password policies for users which specify the number of characters, type, and special characters. 
 
&nbsp;

![password-policy](/blog/assets/2023/advanced-password-policy.webp)


[Advanced Password Policy Manager](https://marketplace.atlassian.com/apps/1228420/advanced-password-policy-manager-for-jira?hosting=datacenter&tab=overview) takes Jira password security to a different level, allowing you to set **tailored password policies**. It helps in improving password security and building **stronger system security**.  

With the add-on, you can allow the admin to set a **custom password** with the help of regular expressions. You can configure a set of **rules** using **regular expressions** (regex) that should be followed by the user while setting/updating their passwords.

&nbsp;

Admins can set multiple security policies like **length** of the **password**, **periodic password change**, as users allow access to a lot of sensitive information while using multiple applications, it is recommended for the Admins to enforce change of passwords frequently for the employees to keep the **data safe**. Admins can also set a **password expiry time** by forcing users to reset their passwords after a certain number of days in order to protect Jira from password interceptions. Admins can also send customized expiry notifications to users when their password expires. 

 &nbsp;

The admin can **limit login attempts**, i.e. the number of failed attempts by users to login, and can restrict access to Jira and JSM by **locking** the user accounts. Password policies can be enabled for your customers and agents for the ServiceDesk customer portal.

&nbsp;

![password-policy-manager](/blog/assets/2023/manage-user-accounts.webp)
 

We have much more on our plate to offer you in our Advanced Password Policy for Jira, here are the **upcoming features**:

- Create **multiple password policies** & assign them to certain users or groups based on their **roles**.
- **Customizable** templates for email notifications.
- **Force** certain users to **reset** their password.
 

Contact Us – Drop us a mail at **info@xecurify.com** or [raise a ticket here](https://miniorange.atlassian.net/servicedesk/customer/portal/2) to talk to us.


Password security is very important in today’s digital world. Atlassian allows you to create a secure environment by letting admins set password policies for users which specify the number of characters, type, and special characters. 

Secure Jira Datacenter With Password Policy Manager


Your accounts are protected with a password but it might not always be secure. Let’s say you are out with your family and your kid wants to buy a toy and you hand in your credit card to pay for it but it keeps getting declined. You are sure that you have enough balance in it to pay for it, but when you check your bank statement it shows it’s in negative and all your negative thoughts end up coming true.

This means that you have been hacked.

Similar issues might happen with your Jira as well. Hackers out there are always ready to pounce on weak passwords, vulnerabilities or leaks in data. This will lead to the possible revealing of your confidential company data. 

What can you do about it?

Well, don’t worry! You can add an extra layer of security with two-factor authentication.

&nbsp;&nbsp;  

**Two-Factor Authentication (2FA)**, also called two-step verification, is a security process in which a user has to pass two different authentication checks to gain access to their account. It helps you prohibit unauthorized access to your application.

To know more about protecting your Atlassian cloud applications check out our previous blog:-
[How to secure Atlassian cloud applications](https://community.atlassian.com/t5/Atlassian-Access-articles/How-to-secure-Atlassian-Cloud-Applications/ba-p/1728600)

[Enable 2FA on Jira for your Customers and skip 2FA for Employees!](https://community.atlassian.com/t5/Jira-articles/Enable-2FA-on-Jira-for-your-Customers-and-skip-2FA-for-Employees/ba-p/1719062)

As 2FA functionality is not already provided in Atlassian Server and Data Center, you can use miniOrange 2FA plugins to enable the 2nd factor of authentication and strengthen access to your Jira accounts. 

Our miniOrange plugin provides you with various 2FA authentication methods like OTP over email, OTP over SMS, Google authenticator, Security questions, Yubikey hardware token, etc.

### OTP over SMS/ Email {#otp-over-email}

OTP (One Time Password) is the most famous & convenient validation technique used by a large number of organizations for two-factor authentication. The OTPs are short-lived and are shared with the user at the time of login. That makes it impossible for the hackers to get access to accounts even if they have user’s credentials.

In the SMS OTP validation technique, an OTP is sent to the user’s mobile phone via SMS. The user has to enter it during the 2FA verification step and the user gets application access only if the OTP is correct. 

We also provide the feature of OTP over Email. Here, the OTP is shipped off to the users on their registered email address. When a user attempts to log in to any device, the server sends an email to their registered company email address with the OTP. The user can then use this OTP to log in.

### Advantages of OTP over SMS and Email {#advantages-of-otp-over-sms-email}

- **Low cost & Ready rollout:**

Since mobile phones and email are readily available to everyone, the cost of implementing OTP over SMS and OTP over Email is very low as one doesn’t need anything extra. (If you use hardware tokens as a 2FA method then each user will need a dedicated hardware device)

- **Easy to use (No setup & no instructions):**

Execution of on-demand OTP delivery techniques is moderately easy for organizations. For instance, with SMS delivery, users don’t have to do any kind of setup and don’t need any extra applications, like authenticator apps, to be installed on their device. They just demand a code which they use at login. 

- **No Shared Secret to Crack:**

On-request OTPs are simply arbitrary numbers sent by the server at the time of login, so there’s no shared secret to be taken advantage of.

&nbsp;&nbsp;  

Reach out to us at **support-atlassian@miniorange.atlassian.net** or raise a support ticket by [clicking here.](https://miniorange.atlassian.net/servicedesk/customer/portal/2)

Two-factor authentication (2FA) adds an extra layer of security to your Jira account by requiring a one-time code (OTP) in addition to your password. To enable 2FA on Jira using OTP over SMS or email, miniOrange provides add-on for Atlassian Jira. 2FA benefits include increased security, reduced risk of data breaches, and compliance with regulations.

Secure your Jira with 2FA (OTP over SMS/ Email)


## The Power of Two-Factor Authentication (2FA): Protecting Your Digital Assets {#the-power-of-two-factor-authentication}

&nbsp;

Gone are, if not yet, then will be, the days when a single password was all that you needed to access your accounts. With our lives becoming more reliant on digitalization by the day, be it shopping and consuming media to working and banking, everything being done via a smartphone, tablet, or laptop it’s no wonder that our online accounts become a magnet for crooks.

&nbsp;

Regular news of cyberattacks against individuals, corporations, and even governments is getting more and more prominent by the day. Data breaches, account hacking, ransomware, cyber extortion, identity fraud, etc. the rise in such cybercrimes propels companies to come up with new security measures and protocols.

&nbsp;

That brings us to the buzz around Two-Factor Authentication. In this blog post, we are going to discuss everything there’s to know about it, what it is, why it’s important, types, and software solutions to implement 2FA. Read on…



### What Is 2FA {#what-is-2fa}

&nbsp;

The login process conducted with a password-only approach is a very vulnerable method as fraudsters are able to quickly hack passwords, especially if they are simple (e.g., date of birth, name), and gain access to accounts. 2FA minimizes the risk of the password-only approach and therefore protects consumers from fraud such as identity theft.

&nbsp;

To break it down, 2FA verifies your identity using two distinct factors from different categories, such as knowledge (password) and possession (code sent to your phone). Let's say you're logging into your email account – you'd enter your password (knowledge factor) and then receive a code on your phone (possession factor) that you must enter as well. That's 2FA in a nutshell!

&nbsp;

2FA has become an industry standard, employed across sectors like finance, technology, and e-commerce, to safeguard user data and thwart unauthorized access. Whether this approach really offers enough protection and security is something that we need to figure out as we take a look at the different types of Two-Factor Authentication and the way it can provide different levels of protection.

### Primary Factors Involved in 2FA {#primary-factors-involved-in-2fa}

When it comes to Two-Factor Authentication, there are three primary factors involved: something you know, something you have, and something you are.

&nbsp;

**Something You Know:** This factor refers to information that only the user should know, such as a password, PIN, or a secret answer to a security question.

&nbsp;

**Something You Have:** This factor involves possession of a physical item or a unique code that only the user possesses. It can be a mobile device, a hardware token, a smart card, or a one-time password (OTP) generated by an authentication app on your phone.

&nbsp;

**Something You Are:** This factor is based on biometric characteristics unique to an individual, such as fingerprints, facial recognition, iris patterns, or voice recognition.

&nbsp;
Combining two or more of these factors in the authentication process significantly enhances security by mitigating the risks associated with relying solely on passwords or single-factor authentication.

&nbsp;

It's worth noting that the choice of factors in 2FA can vary depending on the system or service being used. Some platforms may offer a choice between different factors to accommodate user preferences and the level of security required.

&nbsp;&nbsp;

### Authentication Methods of 2FA {#authentication-methods-of-2fa}

Various forms of Two-Factor Authentication are currently employed,with varying levels of strength and complexity. Nevertheless, all of them provide enhanced security compared to relying solely on passwords. The most common types of 2FA are:

&nbsp;


**Hardware Tokens**
Hardware token 2FA is a formidable security measure that bolsters the protection of online accounts. In contrast to software tokens (we get to it in a bit), hardware tokens are tangible devices, often resembling key fobs or smart cards, that generate one-time passwords (OTPs) or PINs. When users attempt to log in, they initially provide their username and password as the first factor. Subsequently, they input the OTP or PIN generated by their hardware token as the second factor. These tokens come pre-programmed with a shared secret and a synchronized algorithm, ensuring precise and secure OTP generation.

&nbsp;


Hardware token 2FA enhances account security by introducing a robust layer of protection, requiring both something users know (a password) and something they have (the physical hardware token) for access. This dual-factor approach substantially increases the difficulty of unauthorized access, making it a formidable choice for bolstering online security. 

&nbsp;

An example would be Yubikey, a small hardware token that enhances online security through 2FA, requiring both a password and the physical Yubikey for access. It supports various authentication protocols like FIDO2 and U2F, providing robust protection for accounts and systems.

**Software Token (TOTP)**

&nbsp;

Software token 2FA is a security method that strengthens online account protection by introducing a second layer of authentication. Beyond the standard username and password, users employ a software token, typically in the form of a mobile app like Google or Microsoft Authenticator. This app generates time-based one-time passwords (TOTPs) that change at regular intervals, often every 30 seconds.

&nbsp;

When logging in, users input their username and password as the initial factor, followed by the TOTP from the app as the second factor. The TOTP is generated using a shared secret key and a synchronized algorithm, ensuring security. This method significantly enhances account security by requiring something users know (password) and something they have (the software token) for access, making it much more challenging for unauthorized individuals to breach accounts.

**Push Notification**

&nbsp;

A modern and user-friendly approach to enhancing online security. When a user attempts to log in, instead of manually entering a time-based code, they receive a push notification on their registered mobile device from the authentication service or app. This notification typically includes details of the login attempt, such as location and device information. Users can simply approve or deny the login request directly from the notification, making the process quick and convenient.

&nbsp;

Push notification 2FA adds a second layer of security because even if an attacker has the user's password, they will still need physical access to the user's registered device to authorize the login. This approach is user-friendly and provides robust security for online accounts, making it increasingly popular for services and applications aiming to balance security with usability. 

&nbsp;


**SMS Text-Message**

&nbsp;

Think about logging into your cherished online shopping site, anticipation fills the air. As you input your username and password, a prompt for SMS Two-Factor Authentication catches your eye. Curiosity piques your interest, leading you to proceed. In mere seconds, your phone rings with a familiar chime, bearing a text message carrying a unique security code. As you input this code on the website, a comforting sense of reassurance washes over you. The beauty of SMS 2FA lies in its simplicity. It effortlessly dispatches a confirmation code to your mobile device, eliminating the need for additional apps or hardware.

&nbsp;

Just enter the code, and your access is granted—no fuss, no time wasted. Nevertheless, there are certain considerations to bear in mind. SMS 2FA entails divulging your phone number to a third-party, the 2FA provider. While widely accepted for security, this disclosure may spark concerns regarding privacy, personal security, and the potential for targeted advertising. It is essential to carefully evaluate these factors and make an informed decision.

&nbsp;


**WebAuthn**

&nbsp;

WebAuthn is a secure solution that transforms online registration and authentication using powerful cryptography. Created by the FIDO Alliance and W3C, WebAuthn offers convenience with supported web browsers, operating systems, and authentication methods like fingerprints, security keys, or PINs. It provides a phish-proof way to log in and eliminates the need for shared passwords.

&nbsp;

Security is a major advantage of WebAuthn. It's one of the most secure 2FA methods available, allowing web applications to trust strong biometric authentication as a unique credential. However, WebAuthn has drawbacks. Account recovery can be complex due to its ties to a specific device. It would be better to have an alternative authentication method as a backup in case of losing access to the WebAuthn authenticator.


### miniOrange At Work {#miniorange-at-work}
If you are considering 2FA, we invite you to experience the power of miniOrange's user-friendly Two/Multi-factor authentication, designed to fortify the security of your Atlassian applications, be it Jira, Bitbucket, Confluence, Bamboo, or Crowd, our solution goes beyond mere password verification, adding an extra layer of protection by reconfirming the user's identity. 

&nbsp;


With miniOrange, you can rest assured that only the right individuals gain access to your valuable and sensitive information, ensuring your data remains safeguarded and that’s not just for Atlassian but also for Jenkins, Wordpress, Drupal, Joomla, etc.

&nbsp;

### Last But Not the Least {#last-but-not-the-least}

In this article, we've explored the significance of 2FA or Two-Factor Authentication, recognizing its pivotal role in enhancing security. While we've touched upon the concept and the various forms it can take, our journey into the intricate workings and the extensive benefits of 2FA is far from over. Stay tuned for our upcoming article, where we'll delve deeper into how 2FA operates and the manifold advantages it brings to the table, equipping you with the knowledge to make informed choices in safeguarding your digital world.

&nbsp;


So, why wait? Reach us at **+1 978 658 9387** for a demo or email your queries to **support-atlassian@miniorange.atlassian.net**, we would be glad to take it forward from there.





In this first part of the article on 'Two-Factor Authentication' (2FA), we focus on introducing the concept and exploring various methods employed to enhance digital security. 2FA is a crucial layer of defense against unauthorized access, requiring users to provide two different authentication factors before granting access to an account or system. Let's begin!

The Power of Two-Factor Authentication (2FA): Protecting Your Digital Assets


**What is Atlassian Data Center?**

Let’s lay out the foundation on what exactly is Data Center first. In comparison, Server and Data Center differ in that, Data Center allows multiple application servers to run simultaneously, while Server only allows one application server. For this reason, Atlassian Data Center provides high availability and performance for critical Atlassian applications including Jira Software, Confluence, Bitbucket, Jira Service Management, Crowd, and Bamboo on an Enterprise level. Thus Data Center Security is of great concern and basic SSO alone doesn’t suffice. Bearing a full scale Organisation in mind, how do you go ahead and Secure Atlassian DC using 2FA? Let’s figure this out.

**Why should you secure your Atlassian Data center applications?**

We use a variety of applications in our daily lives, and we all understand how important it is in the present era to have security and prevent our data from being exposed to hackers. 

Let’s consider an example where you want to make an online transaction. You use credentials to protect your account from unauthorized access. While making a payment, you have to verify the credentials. This acts as the first line of defence. But there is still room for a hacker to gain access to your banking details compromising your security. So, another layer of authentication is added in the form of an ATM pin or OTP over SMS or email. This serves as the second security measure. Only after both steps does your payment go through. 

Similarly, here your Atlassian applications like JIRA, Confluence, and Bitbucket contain confidential information associated with your account and your organization which must not get in the wrong hands. Making it perennial to Secure Jira Data Center and Secure Confluence Data Center. This content can be protected using our plugins. Not only will our plugin add an extra layer of security, but it will also ensure that the usability and login experience of the users is not compromised.

In this article, we will go over the fundamentals of how to Secure Atlassian DC apps with the help of SSO and 2FA and how they should be used with Atlassian applications. Let’s start understanding it step by step.

Let’s understand what Single Sign-On (SSO), Two-Factor Authentication (2FA) or Multi-Factor Authentication (MFA) are and how they can be used to Secure Atlassian DC using 2FA.

### Single Sign-On (SSO) {#single-sign-on}  

SSO is an authentication process that allows a user to login into a variety of applications using a single set of credentials i.e username and password. miniOrange with its SAML SSO applications also supports login into widely used Atlassian applications and Secure Jira Data Center and Secure Confluence Data Center, Bitbucket, Bamboo, and Fisheye. A single set of credentials can be used to access all and Secure Atlassian DC applications without having to enter the credentials again and again.

![With SSO vs Without SSO comparison](/blog/assets/2023/dc-sso-login-comparison.webp)

### Two-Factor Authentication (2FA) {#two-factor-authentication}

Two-Factor Authentication or 2FA is a security process in which two sets of information are required for authentication i.e something you know along with something you have. For example, you know your login credentials for Atlassian’s Jira such as username and password along with an OTP or a Security token that you have. Two Factor Authentication for Data Center ensures that you can be the only one to access your account. 

### Multi-Factor Authentication (MFA) {#multi-factor-authentication}

Multi-Factor Authentication (MFA) is an authentication process in which a user has to provide multiple factors of authentications in order to gain access to Atlassian Data center. Rather than just asking for a username and password, Multi-Factor authentication adds additional verification factors such as OTP, push notifications and biometrics that help in adding an extra layer of security to your Atlassian application. Multi-Factor Authentication for DC adds more security over Two Factor Authentication for Data Center.

**How does Two-Factor Authentication (2FA) solve username and password problems?**

Atlassian products such as Jira, Confluence are used by all of us, each for a different purpose. To protecting Data Center Security for Jira and Confluence applications with just a username and password is not enough. Therefore adding an extra layer of authentication such as 2FA makes our application more secure and generates single-use code that is either shown in their security token or sent as a text message to a mobile phone. **Two-Factor Authentication for Data Center** protects your devices, accounts, and data from security breaches, phishing, and password brute-force attacks. With the 2FA security enabled from your side, knowing the password alone is not enough for cyber attackers to pass the security check, rest assured having secure Atlassian DC access in your hands.

![miniOrange 2fa working process](/blog/assets/2023/atlassian-2fa-working-process.webp)

**How do SSO and Two-Factor Authentication for Data Center work together?**

Authentication methods such as SSO makes login easier for us. But many times it is seen that people use only a single set of credentials for multiple applications and also save those credentials online. Errors like these can lead to severe data loss. To overcome such flaws, Two-Factor Authentication for Data Center Security can be implemented along with SSO which will add an extra layer of security for data protection.

![miniOrange 2fa with SSO working process](/blog/assets/2023/atlassian-2fa-and-sso-working-process.webp)

There are few ways through which Data Center SSO + 2FA can be implemented together:

- When your Identity Provider(IdP) or Identity Access Management(IAM) supports 2FA, your users will be prompted for 2FA along with Single Sign On.
- When your Identity Provider (IdP) does not support 2FA, you can use an add-on present in the Atlassian marketplace
- Setting up 2FA using add-on in Atlassian for customers who do not use SSO, like clients or customers, while employees can use 2FA in their Identity Provider (IdP) through SSO.

**Identity Providers (IdPs) that support 2FA –**

If you are currently using a commercial Identity Service, you will be offered several choices to implement and Secure Atlassian DC using 2FA. There are a lot of ways through which one can go passwordless these days.

These are names of a few IdP that provide 2FA along with SSO: 

- miniOrange  
- Okta
- One Login
- Azure AD
- AuthO
- Google Cloud Identity

**Dedicated 2FA apps for Atlassian Products:**

There are several add-ons available on the Atlassian marketplace which provide dedicated 2FA plugins for Atlassian Products such as Jira, Confluence, etc. One among them which is highly rated and recommended by customers is [Two Factor Authentication(2FA) by miniOrange](https://marketplace.atlassian.com/search?query=miniOrange%202FA) to Secure Atlassian DC using 2FA.

### Why miniOrange 2FA? {#why-miniorange-2fa}

miniOrange Two-Factor Authentication (2FA) for DC application ensures the right set of eyes have access to your sensitive information sitting on-premise. Among all the plugins present in Atlassian Marketplace which provide Data Center SSO + 2FA/MFA, [Two Factor Authentication for Data Center Security by miniOrange](https://marketplace.atlassian.com/search?query=2FA%20miniorange) provides a wide range of authentication as well as customizable features, one of which is **customizable 2FA on top of SSO**.

Benefits and a few of our top features are mentioned below – 

- **Multi-Language Support through Customizable Templates –** Users can customize a variety of templates depending upon their needs and requirements.
- **Easy Registration –** Notify users to secure their Atlassian account by prompting 2FA configuration setup during user enrollment.
- **Customizable 2FA on top of SSO –** Users can now decide if they want 2FA authentication on top of SSO or if they want to skip it with our customizable feature.
- **Protection against Brute Force Attack –** Lock user accounts after a number of login attempts to prevent brute force attack for Data Center Security.
- **Compatibility –** miniOrange 2FA add-on is compatible with Jira, Confluence, Bitbucket and Bamboo Server, and Data Center versions. 2FA for Crowd will be released soon.
- **User-Friendly –** miniOrange 2FA plugins are easily deployable and can be configured easily. We also provide end-to-end configuration support for a new user. 
- **24/7 high-quality support –** We provide 24/7 high-quality support through calls as well as through emails.

For a detailed information of Data Center SSO + 2FA/MFA implementation with Atlassian Application refer to this document about Two Factor Authentication for Data Center & Cloud.

&nbsp;&nbsp;  

Reach out to us at **support-atlassian@miniorange.atlassian.net** or raise a support ticket by [clicking here.](https://miniorange.atlassian.net/servicedesk/customer/portal/2)

Best way to Secure Your Atlassian Data Center (DC)


## Log into Atlassian Cloud using External OAuth/OIDC Provider

Atlassian Cloud has become very popular in the last couple of years. It offers competitive pricing, especially for small user-tier applications. Since the announcement of Server discontinuation by Atlassian, more and more customers are moving to Cloud and Data Center. You can check out our article to see if Atlassian Cloud is a good option for you here – [Atlassian’s Server License Discontinuation: What are your options?](https://community.atlassian.com/t5/Atlassian-Cloud-Migration/Atlassian-s-Server-License-Discontinuation-What-are-your-options/ba-p/1635739#)

### What is Atlassian Access? {#what-is-atlassian-access}

Atlassian Access is an enterprise-grade subscription for enhanced security that provides centralized administration and governance. Atlassian Access SSO has security controls like [SAML Single Sign On (SSO)](https://www.atlassian.com/software/access/guide/elements/single-sign-on#how-it-works), User Lifecycle Management, Active Directory Sync, and many more. All these features span across all Cloud apps inclusive of Jira Software, Jira Service Management, Confluence, Bitbucket, Trello, and Statuspage spanning over organizations giving you the ability to use Jira SSO and Confluence SSO.

![Atlassian Access](/blog/assets/2023/atlassian-access.webp)

Single Sign-On into Atlassian Access allows users to authenticate to Atlassian Cloud products through your existing SAML 2.0 Identity Provider giving you the ability to enable and use Atlassian Cloud Jira SSO and Atlassian Cloud Confluence SSO. Cloud SAML Single Sign On (SSO) provides employees with a simple and easy process for accessing the tools that they use and allows admins to enforce identity-related security controls at scale, making the task of securing large groups of users far simpler.

What if users are present in OAuth or OpenID Provider? Will SSO still work? How can we connect Atlassian Cloud (SAML SSO modules) to OAuth/OIDC Providers? Is it even possible?

**YES! It’s possible with miniOrange’s Identity Brokering Service.**

### What is miniOrange Identity Brokering Service ? {#what-is-miniorange-identity-brokering-service}

Identity brokering is a way to establish trust between any two applications that do not speak the same language. Identity Brokering is a service that connects multiple service providers with different Identity Providers. Atlassian Access only allows SAML requests & responses. If your organization uses OAuth/OIDC protocol and would like to use Atlassian Access for Single Sign-On, you’re in somewhat of a fix! This is where miniOrange Identity Brokering comes into play.

![miniOrange Identity Broker Service](/blog/assets/2023/identity-broker-service.webp)

It establishes trust between any two applications like Atlassian Access SSO (SAML) and any OAuth/OIDC Provider that does not speak the same protocol and helps them understand requests and responses. This will be equivalent to a language translator where translators understand one language and translate it into another language. While using a translator, one needs to know at least one of the languages, whereas while using our product – you do not need to worry about any of the protocols. Users will still see the same flow which they see with other apps. **On accessing Atlassian, they will see the OAuth Provider’s login page, they will not see any miniOrange page or login screen in between, so users will not notice the integration with miniOrange**.

You can use both Cloud Jira SSO and Cloud Confluence SSO through one centralized miniOrange offering. Applications that do not communicate with each other using the same protocol are known as cross-protocol applications.

Over the years we have developed many standards for doing this like SAML, OpenID, OAuth, OpenID Connect, but the problem is that very few people can get these protocols talking to each other safely and quickly. miniOrange’s Identity Brokering, built-in to our proprietary Identity Provider product has one feature all good products have – you don’t need to worry about the underlying technology, protocols, tokens.

![miniOrange Identity Brokering](/blog/assets/2023/atlassian-miniorange-identity-brokering.webp)

Our Identity broker service hides all the complexity of these protocols and provides a simple HTTPS endpoint for parties to use. Without implementing SAML, OpenID, OAuth, or OpenID Connect, you can suddenly start speaking these languages and have access to identity and access tokens from hundreds of providers. The only thing you will need to know is how to call an HTTPS endpoint which is much simpler than understanding different standards. This is similar to users’ experience for Atlassian Access SSO when connecting to a SAML Identity Provider.

On the miniOrange side, you must configure

1. **Atlassian Access SAML SSO Application** as a **Service Provider** and **miniOrange** as an **Identity Provider**.
2. **OAuth or OIDC Provider** as an **Identity Source** in **miniOrange** where **miniOrange** is the **OAuth Client** to enable OAuth SSO or OIDC SSO for easy login.

Once the connection is successful, you are good to go. You can refer to this [document](https://idp.miniorange.in/what-is-identity-brokering/) for end-to-end setup.

Using miniOrange Identity Broker Service, you can also connect multiple Providers or add user directories. You can enhance Atlassian Cloud security by enabling Secure login with Two Factor Authentication (2FA) or [Multi-Factor Authentication (MFA)](https://idp.miniorange.in/what-is-identity-brokering/) in miniOrange.

What do you think about this solution? Do you think this would be helpful for Cloud users trying to authenticate from an external OAuth Provider?

Please drop us a mail at info@xecurify.com or raise a ticket [here](https://miniorange.atlassian.net/servicedesk/customer/portal/2) to talk to us.

You can learn more about our Identity Brokering features here – https://www.miniorange.in/identity-broker-service

You can take a tech deep dive into the solution here – https://idp.miniorange.in/what-is-identity-brokering/


Atlassian Cloud offers competitive pricing, especially for small user-tiers. Here comes Atlassian Access an enterprise-grade subscription for your SSO needs.

Log into Atlassian Cloud using External OAuth/OIDC Provider


## SSO into Jenkins while managing users in Atlassian Crowd

![Atlassian Crowd and Jenkins integration](/blog/assets/2023/atlassian-crowd-and-jenkins-integration.webp)

Jenkins manages and controls software delivery processes throughout the entire lifecycle, including build, document, test, package, stage, deployment, static code analysis, and much more. To make Jenkins application access easier and provide better security we have an [SSO module](https://plugins.miniorange.in/jenkins-saml-single-sign-on-sso) that can be integrated with Jenkins easily and deployed on Jenkins platforms with some of the most important features like **Just-In-Time User & Group Provisioning**, **Auto Redirect to IdP**, **Signing & Encryption**, **Custom User Attribute Mapping**, **Single Logout**, **Manual Group & Role Mapping** and many more. 

Atlassian Crowd is a powerful tool that enables users to create sessions for multiple Atlassian products like Jira, Confluence, Bitbucket. The Crowd is a centralised identity for access management application that manages the users from various directories like Active Directory, LDAP, Open LDAP, Microsoft Azure Active Directory for connected applications. These capabilities can now be applied to Jenkins as Crowd connector for Jenkins.

Now, enterprises are looking to delegate user authentication for the applications from Crowd to central IAM (Identity & Access Management) applications for better security. But Crowd is still required to manage users and permissions. This use-case is possible with the help of connectors we have developed for these Atlassian applications like [Jira](https://marketplace.atlassian.com/apps/1220053/mo-sso-connector-for-crowd-and-jira?hosting=datacenter&tab=overview), [Confluence](https://marketplace.atlassian.com/apps/1220055/mo-sso-connector-for-crowd-and-confluence?hosting=datacenter&tab=overview), and [Bitbucket](https://marketplace.atlassian.com/apps/1220057/mo-sso-connector-for-crowd-and-bitbucket?hosting=datacenter&tab=overview). Jenkins, however, is a non-Atlassian application, thus integrating this flow with Jenkins is difficult. 

![Atlassian apps and Jenkins integration](/blog/assets/2023/atlassian-apps-and-jenkins-integration.webp)

### How does the miniOrange plugin handle this use case? {#miniorage-plugin-solution}

miniOrange haS developed a [Jenkins Crowd SSO Connector](https://miniorange.atlassian.net/servicedesk/customer/portal/2) capable of creating user sessions by reading the Crowd session. Like any other Atlassian application like Jira, Confluence and Bitbucket, you can manage groups and permissions from the Crowd. You can authenticate to the Crowd via SAML SSO using the [Crowd SAML SSO](https://marketplace.atlassian.com/apps/1218304) plugin. With the help of Jenkins Crowd SSO connector, you can invoke SSO from Jenkins itself. You do not need to login into Crowd explicitly.

### How does it work? {#how-does-it-work}

Crowd SAML SSO Plugin acts as a SAML Service Provider and is used to enable trust between Jenkins and the central IAM applications. Crowd SAML SSO plugin takes care of the SAML Request, SAML response, and user session management at the Crowd end. Once the Crowd session is created, Jenkins reads this session and the user is logged in to Jenkins. Users can invoke SSO from Jenkins itself.

Here, IAM will perform the user authentication. The crowd will be used to manage users and their groups (permissions) for all the connected applications.

Also, with this flow, end-users will experience a seamless login and won’t notice that the SSO request and response passes through the Crowd Server.

**Let’s understand the Workflow!**

1. The user tries to access the Jenkins application.
2. For authentication, the users would get forwarded to the IAM application’s login page.
    1. The Jenkins Crowd SSO Connector will redirect users to the Crowd SAML plugin.
    2. The Crowd SAML plugin will forward the user to the IAM application for authentication.
3. Once the authentication is successful, the user will be redirected back to the Jenkins application and logged in.
    1. IAM sends a response back to the Crowd SAML plugin.
    2. Crowd SAML plugin validates the user creating the user session, and redirects the user to the respective application form where the SSO was invoked.
    3. Users will be granted access to Jenkins based on their groups and applications configured on Crowd.

![Atlassian apps and Jenkins integration](/blog/assets/2023/jenkins-crowd-connector-workflow.webp)

### What are the Key Benefits? {#what-are-key-benefits}

1. There is only one set of SAML configurations for all the Atlassian & Non-Atlassian applications.
2. User authentication moved to central IAM without losing any of the existing user permissions.
3. Users will be able to access all the connected applications using their IAM credentials.
4. This method makes it simple to add an extra security layer, such as MFA, on top of the SSO, which was not available while utilizing Crowd for SSO.

What do you think of this solution? Do you think this would be helpful in centralizing authentication for your users? Drop us a mail at [info@xecurify.com](mailto:info@xecurify.com) or [raise a ticket here](https://miniorange.atlassian.net/servicedesk/customer/portal/2) to talk to us.

miniOrange Jenkins Crowd SSO Connector is capable of creating user sessions by reading the Crowd session.

SSO into Jenkins while managing users in Atlassian Crowd


## Seamless SSO and Identity Management {#seamless-sso-and-identity-management}

In the ever-evolving landscape of digital identity, achieving simplicity and efficiency is paramount. With the latest upgrade to the miniOrange SAML plugins, we're excited to announce the seamless integration of SCIM (System for Cross-domain Identity Management). This transformative addition, bundled for free with the miniOrange SAML plugins, brings a new dimension to your identity management strategy. 

&nbsp;

**This upgrade is available for all the following plugins:-**
1. [JIRA SAML Plugin](https://marketplace.atlassian.com/apps/1215430/mo-jira-saml-sso-single-sign-on-jira-sso-login?hosting=datacenter&tab=overview)
2. [Confluence SAML Plugin](https://marketplace.atlassian.com/apps/1215542/mo-confluence-saml-sso-single-sign-on-confluence-sso-login?hosting=datacenter&tab=overview)
3. [Bitbucket SAML Plugin](https://marketplace.atlassian.com/apps/1216482/mo-bitbucket-saml-sso-single-sign-on-bitbucket-sso-login?hosting=datacenter&tab=overview)

### Unlocking Synergy: SAML and SCIM in Harmony {#unlocking-synergy-saml-and-scim-in-harmony}

**Effortless Onboarding and Offboarding** 🧑‍🤝‍🧑
Imagine a new team member, Sarah, joining your organization. SAML seamlessly grants her access across applications with Single Sign-On (SSO). Before that, SCIM works behind the scenes, instantly creating her accounts and access rights. When another employee John leaves the company, SCIM steps in again, ensuring immediate removal of his access across all applications without manual intervention.

&nbsp;

**Streamlined User Attribute Management** 🚴
Maintaining consistency in user attributes is crucial. For instance, when Sarah gets promoted and joins a new team, SCIM ensures her updated role and group memberships are uniformly reflected across all applications. This meticulous approach eliminates discrepancies in user profiles and enhances accuracy.

&nbsp;

**Enhanced Security through Real-time Access Management** ⏳
Picture this: David, a team member, is terminated. SAML provides secure and straight forward authentication, and when combined with SCIM, it allows you to instantly revoke David's access. This immediate response fortifies your security posture and minimizes potential risks by promptly removing access for deactivated or terminated users.

&nbsp;

**Scalable Identity Management for Growing Organizations** 🦸
As your organization expands, managing user identities can become complex. SAML ensures a unified and secure authentication process. Now, consider Sarah's team growing. SCIM simplifies the complexity of user provisioning, allowing you to easily scale your identity management processes without compromising efficiency. In this dynamic scenario, imagine new team members joining rapidly. SCIM, the superhero of identity management, automates user provisioning, ensuring seamless access for new members to the tools they need. This dual approach of SAML and SCIM not only guarantees a secure authentication process but also streamlines identity management, making it agile and scalable as your organization evolves.

&nbsp;

### How to Experience the Synergy: {#how-to-experience-the-synergy}

1. Update Your miniOrange SAML Plugin to the latest version.
2. Go to the “SCIM” tab in the settings section. You need to download the SCIM plugin separately but it will be available at no extra cost once you purchase our SAML plugin.
3. Here, you can seamlessly configure and customize your SCIM settings to align with your organization's requirements.
4. Once configured, witness the harmonious collaboration between SAML and SCIM. Enjoy the benefits of secure SSO and automated user provisioning, making identity management a smooth and efficient process.

&nbsp;

**Elevate Your Identity Management Strategy** 👆
With SAML and SCIM working in tandem, miniOrange offers a robust solution for organizations seeking a streamlined, secure, and scalable identity management strategy. Upgrade your miniOrange SAML plugin today to unlock the combined power of SAML and SCIM, where simplicity meets security in the realm of digital identity.



In the ever-evolving landscape of digital identity, achieving simplicity and efficiency is paramount. With the latest upgrade to the miniOrange SAML plugins, we're excited to announce the seamless integration of SCIM.

Seamless SSO and Identity Management: Unleashing the Power of SAML and SCIM Integration in miniOrange Plugin 🚀


## User Provisioning App : Keeps you in sync with multiple Atlassian applications! {#keeps-you-in-sync-with-multiple-atlassian-applications}

[Advanced Option for Atlassian SSO Plugin](https://marketplace.atlassian.com/apps/1229209/advance-options-for-atlassian-sso?hosting=datacenter&tab=overview)

Picture this: You have 1000s of users. Each user accesses multiple atlassian applications like Jira and Confluence and some of them keep facing issues with user access, activation and deletion which by the time you resolve, you have another pile waiting for you. Sounds familiar? 

&nbsp;&nbsp;

How are you going to manage user provisioning and de-provisioning and access of every user for each application? Manually managing large numbers of users is equivalent to putting out fires all day long. We’ve got you covered with our User Provisioning /SCIM add-on, which can help you to handle your users/employees instantly and effortlessly across atlassian applications for Jira SCIM and Confluence SCIM. Wondering how is it possible? We will help you to understand exactly how it can be done.

### What is User Provisioning and Deprovisioning? {#user-provisioning-and-deprovisioning}

User Provisioning is the process of creating, updating and/or deleting a user’s account and access through multiple applications at once. In our particular case this user sync or SCIM can be applied to Atlassian applications for Jira User Sync and Confluence User Sync. Provisioning provides information about users / employees such as their name, attributes, groups and other relevant data allowing them to grant or revoke access as required. Some of the real time examples like hiring, promotions, transfers can set off provisioning. Provisioning ensures user’s access rights are up to date, without manual efforts for each user across all applications.

&nbsp;&nbsp;


### Why is User Provisioning / Deprovisioning important? {#Why-is-user-provisioning-deprovisioning-important}

- Automatically create, update, deactivate or activate user accounts across applications.
- Saves time, manages users directory at one place and keeps everything else sync with directory.
- Automatically assign role-based permissions within apps
- Ensure the prevention of unauthorized access by automatically revoking access to all apps at once – de-provisioning.

### Ready for the action? Install User Sync today! {#ready-for-the-action-imstall-user-sunc-today}

- It’s really easy to manage users via our developed user provisioning add-ons which can be connected with your IDPs (Azure AD, Okta, OneLogin,G suite, Keycloak) or any other SCIM compliance applications so when you setup your Jira azure AD SCIM or Jira Okta SCIM, user sync plugin will make it a cakewalk for you. Follow the guide to quickly set it up for the Server or Data Center version.
- The add-on also works with Single Sign On where SSO is used for authentication and User sync application is used for automatic provisioning.

 
Contact Us – Drop us a mail at **info@xecurify.com** or [raise a ticket here](https://miniorange.atlassian.net/servicedesk/customer/portal/2) to talk to us.





User Provisioning is the process of creating, updating and/or deleting a user’s account and access through multiple applications at once. In our particular case this user sync or SCIM can be applied to Atlassian applications for Jira User Sync and Confluence User Sync.

User Provisioning App : Keeps you in sync with multiple Atlassian applications!


**Enable Jira 2FA for Customers and skip for Employees**

REST API is an application interface that allows an application to expose its resources securely to client applications. REST APIs let you securely integrate with Jira server or Jira data center by querying and modifying data in your Jira application. Since the rest APIs are open to the internet and anyone can use them to gain illegitimate access and modify sensitive resources, it is crucial to authenticate each API call made to the server.

**Authentication methods to Secure APIs are as follows:**
- Basic Authentication
- API Key Authentication
- OAuth 2.0 Authentication

We will learn about them briefly below.

### Basic Authentication: {#basic-authentication}

Basic authentication is a simple authentication scheme built into the HTTP protocol. In Basic Authentication, the client sends an encoded username and password for authentication. Since username and password sent can be easily deciphered, there is an inherent security vulnerability when using Basic authentication. With basic authentication, every API call is an opportunity for credential theft, which is not ideal. Hence not it is not recommended.

![Rest API Basic Authentication](/blog/assets/2023/rest-api-basic-authentication.webp)

**Authentication methods for SSO Enabled Jira Server:**

If the application is federated using SSO protocols such as SAML/OAuth/OIDC, the user generally does not know his/her application credentials. The user only knows the credentials of the Identity Provider. Hence basic authentication in such cases does not work. In this case, you can use the methods below.

### API Key Authentication {#api-key-authentication}

Use API Keys as an alternative to basic authentication for protection is to secure REST APIs from unauthenticated users. API Key authentication generates a random authentication key for you. Using this key, you can authenticate the REST API by sending it in the authentication request instead of a password. For more security, you can revoke & generate API keys.

From a usability point of view, there are some pros to using API Keys.  One of the clear advantages is its inherent simplicity as well as security. A single identifier is simple, and for some use cases, the best solution since they work better as unique app identifiers. We provide support for API key Authentication where you can additionally control which users can call the secure REST APIs.

![Rest API API Key Authentication](/blog/assets/2023/rest-api-api-key-authentication.webp)

### OAuth 2.0 Authentication {#oauth-2.0-authentication}

This method allows you to authenticate the secure REST APIs of your application using any OAuth/OIDC providers. A client calling a secure REST API can fetch an access token from the OAuth/OIDC provider and use this access token to authenticate an API call.

It is fundamentally a much more secure and more powerful method than the other approaches, mainly because it allows the establishment of scopes that can restrict or provide access to different parts of the API service. It is the best solution for those who have external OAuth2.0 providers. As an added advantage, the token gets revoked after some time, making it much harder to be re-used by attackers.

![Rest API OAuth 2.0 Authentication](/blog/assets/2023/rest-api-oauth-authentication.webp)

Try out our REST API Authentication app. The app supports various methods like API Token, OAuth 2.0/OpenID token, etc. and it also provides configurable access control to block the REST API calls made using basic authentication or OAuth 1.0.

For detailed information about our REST API Authentication app, please refer this [link](https://www.miniorange.in/atlassian).

In case you have any other use cases or have any queries, then please feel free to raise a ticket [here](https://miniorange.atlassian.net/servicedesk/customer/portal/2).

Since rest APIs are open to the internet, anyone can gain illegitimate access to it. Thus making it crucial to validate each API call made to the server. Secure Jira/Confluence data Center Rest APIs with our advanced authentication methods. Try our REST API Authentication app. The app supports various authentication methods like API Token, OAuth 2.0/OpenID token, etc. and it also provides configurable access control to block the REST API calls made using basic authentication or OAuth 1.0.

Authentication methods to Secure Jira/Confluence data center Rest APIs


## Secure Data in Jira and Confluence using WebAuthn {#secure-data-in-jira-and-confluence-using-webauthn}

Passwords are difficult to remember, driving individuals to pick feeble ones and reuse them again and again. Passwords are additionally simple to phish, with security attacks that happen from time to time. Even if you have a complex password set for your account, there are multiple ways in which it can be hacked.

&nbsp;&nbsp;

Even assuming your password is uncovered and ends up with a hacker, if you utilize WebAuthn, they actually can’t break your record. That is the thing that makes WebAuthn such a strong security initiative.

### What is WebAuthn? {#what-is-webAuthn?}

WebAuthn or Web Authentication API permits web applications to integrate secure verification for both multi-factor and single-factor authentication. Utilizing WebAuthn, web applications can build security to prevent phishing attacks and ease user experience with passwordless verification. This means your Jira or Confluence can be easily configured to use your device’s FaceID recognition, Fingerprint, or any hardware token. In this way, your users don’t need to remember a password for each login, and the login experience will completely be passwordless. 

&nbsp;&nbsp;

The Web Authentication API (otherwise called WebAuthn) is composed of the W3C and FIDO. The API permits workers to enlist and confirm clients utilizing public key cryptography rather than a password. As of January 2019, WebAuthn is supported on Chrome, Firefox, and Edge, and Safari.

**Is this all you need? What if you could decide how your users log in to Jira and JSM?**

We provide additional features on top of your Atlassian native SSO, miniOrange’s [advanced option for the SSO plugin](https://marketplace.atlassian.com/apps/1229209/advance-options-for-atlassian-sso?hosting=datacenter&tab=overview).

Contact Us – Drop us a mail at **info@xecurify.com** or [raise a ticket here](https://miniorange.atlassian.net/servicedesk/customer/portal/2) to talk to us.

&nbsp;&nbsp;

Since the basic use case of SSO is satisfied by the Native SSO already, hence we decided to enhance the functionality of SSO by offering two distinct features :- 

1. SSO Redirection Policy
- Default rule (redirect to URL or IDP)
- Domain based redirection
- Group based redirection
 
&nbsp;&nbsp;

2. SSO Authentication Template
- Login Template
- Logout Template

1. SSO Redirection Policy:
This allows the users to have a set of rules that will decide how users will log in to Jira and JSM. Depending on the configuration, you can choose which users need to be re-directed to the configured IDP or the login page. Every end-user will be required to enter the username or email address, then they will be matched against some pre-configured rules by the admin.

- Default rule –

URL or IDP – enabling this rule will redirect your users directly to the intended URL or IDP without clicking on any buttons or links.
- Domain based redirection –

This redirects the users to the configured IDP or Jira login page on the basis of the domain of the user.
- Group based redirection –

It redirects the users to the IDP or Jira login page on the basis of the groups they belong to. 

You can set multiple rules and decide their order of priority.

&nbsp;&nbsp;

2. SSO Authentication Template :–
We understand the importance of visual aesthetic and ease of understanding! This is exactly what this feature does, it gives the flexibility to the user to design their login and logout template as per their requirement. They can make it visually appealing or customize it as they like to.

&nbsp;&nbsp;

**Design the UI of login template:**

- Custom login template : To enhance the look and feel of login page UI custom login template will allow you to customize and display an easy-to-use login page to the end-users.
- Custom logout template : Pretty similar to login template, it can be used to change the message after the user has logged out and show any custom message.

Wait! That’s not all. We have some exciting upcoming features too 

- Advance on-the-fly group provisioning
- Manual group mapping
- Group filter
- Group regex
- Additional user properties

### How do you achieve this? {#how-do-you-achieve-this}

**Our WebAuthn plugin is here to solve all of your security issues!**

The [miniOrange WebAuthn plugin](https://marketplace.atlassian.com/apps/1225055/mo-webauthn-passwordless-login-for-jira?hosting=datacenter&tab=overview) doesn’t request a secret key or any password. This is because it makes a one-time verification token each time you sign in, it fundamentally follows the suggested security practice of making a secure password for each site. 

&nbsp;&nbsp;

What’s more, does it use your device’s in-built fingerprint scanner or face scanner or your local credentials? Yes, it does and it does not require any additional hardware which you have to invest in or need to carry all the time, you can simply use your own device’s authenticator to log into your Atlassian applications (Jira, Confluence, Bitbucket etc) securely.

&nbsp;&nbsp;

WebAuthn upholds two fundamental classifications of validation: **biometrics and hardware security tokens.** 

&nbsp;&nbsp;

### What’s the secret behind WebAuthn how does it work? {#whats-the-secret-behind-webauth?}

An important aspect of understanding WebAuthn is public keys. Public keys can be shared with everyone in the system and anyone can use it. Once the sender has the public key, he uses it to encrypt his message.

&nbsp;&nbsp;

Each public key comes paired with a unique private key. Think of a private key as the key to the front door of a business where only you have a copy. The private key ensures only you can get through the front door.  

&nbsp;&nbsp;

Together, these keys help to ensure the security of the exchanged data. A message encrypted with the public key cannot be decrypted without using the corresponding private key.

### How does our plugin work? {#how-dows-our-plugin-work}

Our WebAuthn add-on for [JIRA](https://marketplace.atlassian.com/apps/1225055/mo-webauthn-passwordless-login-for-jira/version-history), [Confluence](https://marketplace.atlassian.com/apps/1225056/mo-webauthn-passwordless-login-for-confluence/version-history), and [Bitbucket]{https://marketplace.atlassian.com/apps/1225057/mo-web-authentication-api-webauthn-for-bitbucket?hosting=server&tab=overview} allows administrators to manage authentication for individuals or groups of users. You can enable WebAuthn for specific users or groups of users, depending on who you believe needs this feature the most.

If a user is experiencing issues with their authenticator, the admin can reset the configuration for that user from the plugin or allow that user to bypass the WebAuthn authentication, so they can access the Atlassian Applications.

![Webauthn](/blog/assets/2023/webauthn-architecture-diagram.webp)

User Authentication requests will be sent using local authenticators. Successful authentication will generate a key pair (public key, private key). Out of which, the public key will be stored in a remote database and the private key will be kept with the local machine.

&nbsp;&nbsp;

These two keys will work together to provide the system with an extra layer of security and improve user experience.

&nbsp;&nbsp;

While using the WebAuthn, users will be asked to set up the local authenticator to sign in to the Atlassian application, by providing valid credentials.
&nbsp;&nbsp;

![Webauthn](/blog/assets/2023/configure-web-auth.webp)

After successful registration of their authenticators, from next time users can use those for logging into their Atlassian application without any hassle.


### Conclusion {#Conclusion}

Welcome to the promised land in the form of passwordless login. This new method offers just that, a way to remove the need for a password and have automated login via a device/biometric – no second factor  – **WebAuthn is the only factor**. WebAuthn is based on public-key cryptography.

In a nutshell, signatures are sent between a relying party (usually website) which stores the public key, and an authenticator (device or browser) and a biometric to authenticate you to the device – it’s neat, it’s easy to implement, it has some excellent security features that can help with the safety of your data, prevent phishing using biometric – and a panacea to authentication.


Contact Us – Drop us a mail at **info@xecurify.com** or [raise a ticket here](https://miniorange.atlassian.net/servicedesk/customer/portal/2) to talk to us.





Passwords are difficult to remember, driving individuals to pick feeble ones and reuse them again and again. Passwords are additionally simple to phish, with security attacks that happen from time to time.

Secure Data in Jira and Confluence using WebAuthn


## What is Confluence Secure Share?

It’s pretty common that help may arrive from unexpected places. 

Your company might end up getting help from anywhere whether it be a small or a big company. But, the question arises how it will help your company if they don’t have access to your company’s projects. You have to share your confluence pages with them for them to help you out.

&nbsp;&nbsp; 

[Confluence External Share/Confluence Secure Share](https://marketplace.atlassian.com/apps/1225078/mo-secure-share-pages-for-confluence-external-share?hosting=datacenter&tab=overview) allows you to **share your Confluence pages** to any external user, i.e a non confluence user, **without making it public**. In short one can share pages of Confluence to non-confluence users as well. The external shareable Confluence pages can be protected by password, and you can also set their expiry time. If a shared page has expired, it won’t be accessible to external users anymore. This way you can safely share confluence pages without the tension of the data being stolen or harmed.

&nbsp;&nbsp; 

Thus, your **Confluence space is kept secure in the most protected way** by sharing the pages without making the space public(anonymous). It permits you to make & share access links for your Confluence pages. Your end-users will be able to access the shared Confluence pages with these links without login.

Want to know why we introduced Confluence External Share or secure share?

Well the simple answer is to share pages of Confluence.

&nbsp;&nbsp; 

Let’s go back to square one…

What are the possible ways by which you can share your information with another company without hindering your data security. Take a guess…

Taking your desktop to their organization personally and showing it to them or calling them over to your company?

&nbsp;&nbsp; 

**Take a picture of it from your other device and personally message them? Or just share your user name and password for them to access it?**

**Major problem, right?**

Well now you don’t have to worry about it anymore. miniOrange has come up with a solution to share your confluence pages without putting your company’s project details in danger.

Our Secure share for confluence is the way to protect your projects and data even while sharing it with external users. 

### What is an External User? {#what-is-an-external-user}

Any other user which does not have access to your confluence page becomes an external user. You might want those users to not have full access to your confluence pages. You might want them to just view your pages or just comment on it or add attachments.

Our plugin helps you do what you require.

### Worried about licensing ? {#worried-about-licensing}

You might be thinking about the license. As those users might not have an Atlassian account or confluence license.

Our plugin solves the problem of creating new licenses for external users. You can save a lot by just installing our plugin. As you will not have to create an extra license for every external user.

Give it a thought.

### Need of Secure Share/ External Share for Confluence {#why-you-need-secure-share}

Confluence Secure Share/External share supports sharing the pages with every anonymous/external user with no restriction on the basis of **who to share with**, **when to share**, and **how to protect the shared page** even if it’s available for anonymous users.

Confluence also has in-built features to share **Confluence pages with limitations** where you could **either share your pages with licensed users**, or you’ll have to **make your whole space public on the internet** to externally share your Confluence pages with non-licensed users which makes it more **vulnerable** to security threats.

### Confluence – Secure Share: The Ultimate Solution! {#introducing-secure-share}

This application tackles perhaps the greatest challenge for the organizations utilizing Confluence. **Licensed users can share Confluence pages** through **password protected links to the external users** who do not have a Confluence account.

![Confluence Secure Share](/blog/assets/2023/confluene-secure-share.webp)

### Features of Secure Share/External Share for Confluence (Data Center/Server): {#confluence-secure-share-features}

- **Create and share access links** for any Confluence page which does not require login
- **Set permissions for end-users** to View/Add Comments/Attachments in the shared pages
- **You can password-protect your shared link** with your own password or generate a random one for better security
- **Set validity for the shared link**
- **Deactivate the shared link** according to your convenience
- **Hassle-free deletion** for expired secure links
- **Free support** app setup. [Contact us](https://miniorange.atlassian.net/servicedesk/customer/portal/2) for a Secure Share demo!

### Upcoming Features & Customer Support {#upcoming-features-and-support}

- Share your Confluence spaces with external users in a single click.
- Admins can choose to restrict sharing of Confluence pages from certain spaces.
- Keep user logs for accessing the share links

With immense customer support, we are here to help you with everything! Let us know your requirements at [info@xecurify.com.](mailto:info@xecurify.com)

Confluence External Share/Secure Share allows in secure sharing of Confluence pages externally with users saving extra license cost for additional/external users. With Confluence External Share/Confluence Secure Share you can share your Confluence pages to any external user without making it public. Furthermore, the shared Confluence pages can be protected by password, and you can also set their expiry time.