Jira SSO Logout Loop and UI Issues Across Plugin Versions

Hello Microsoft Entra Community,

We are experiencing issues with the Microsoft Entra ID Single Sign-On integration in our Jira Service Management Data Center environment and would appreciate technical guidance.

1. ENVIRONMENT DETAILS

Application: Jira Service Management Data Center
Jira/JSM Version: 10.3.26
Identity Provider: Microsoft Entra ID

PLUGIN VERSIONS AND ISSUES

Version 1.1.11:
We are experiencing an infinite SSO authentication redirect loop when customers log out of the JSM portal while Force Azure Login is enabled.

Version 1.3.7:
We are experiencing UI functionality issues after upgrading the plugin.

Version 2.0.7:
The logout/authentication redirect issue is also occurring in this version.

CURRENT CONFIGURATION

Force Azure Login: Enabled
Enable Single Signout: Enabled

2. ISSUE DESCRIPTION

When a customer logs in to the JSM portal using Microsoft Entra ID SSO and clicks Logout, Jira successfully terminates the local session.

However, the Microsoft SSO plugin immediately redirects the user to Microsoft Entra ID. Since the Microsoft session is still active, the user is silently authenticated again.

The plugin reports successful authentication, but Jira considers the user unauthenticated on the subsequent request. This results in a continuous redirect loop between Jira and Microsoft Entra ID.

3. FINDINGS FROM ATLASSIAN SUPPORT

We raised a support request with Atlassian. Their technical investigation confirmed the following:

1. Jira successfully terminates the user session during portal logout.
2. Force Azure Login triggers a new authentication request immediately after logout.
3. Microsoft Entra ID silently authenticates the existing Microsoft session.
4. The plugin logs successful authentication.
5. Jira does not retain the authenticated session on the next request.
6. The /plugins/servlet/saml/logout endpoint is not invoked during JSM portal logout.

Atlassian observed six authentication redirect cycles within approximately 15 seconds.

Their conclusion was that Jira logout is working as expected and the issue appears to be occurring within the Microsoft Entra ID SSO plugin's authentication flow.

TROUBLESHOOTING PERFORMED

We temporarily disabled Force Azure Login while keeping Single Signout enabled.

After this change, the logout redirect loop stopped, and the browser remained on the JSM portal login page.

However, our requirement is to retain both Force Azure Login and Single Signout.

4. ASSISTANCE REQUIRED

1. Are there any known defects in plugin versions 1.1.11, 1.3.7 or 2.0.7?
2. Why does the plugin report successful authentication while Jira does not retain the authenticated session?
3. Why is the SAML logout endpoint not invoked during JSM customer portal logout?
4. What is causing the UI functionality issues observed in version 1.3.7?
5. Why does the logout/authentication issue persist in version 2.0.7?
6. Which plugin version is officially recommended for Jira/JSM 10.3.26?
7. Is there a recommended configuration or permanent workaround that allows us to retain both Force Azure Login and Single Signout?

We would appreciate technical guidance from the Microsoft Entra engineering team or anyone who has encountered and resolved similar issues.

Our objective is to maintain a stable SSO integration while retaining both required security settings.

Thank you for your assistance.