How to migrate your Trello Enterprise domain claims and SSO to Atlassian Access
This page will help you prepare to move to the new version of Trello Enterprise and Atlassian Access as part of your Enterprise renewal process.
As a Trello Enterprise admin, you will find the steps required to set up Atlassian Access and link your enterprise to an Atlassian organization.
When will Atlassian Access apply to the members of my Trello Enterprise?
Unless they are already using other Atlassian products, users who are managed by your Trello Enterprise will not appear in your Atlassian organization or be subject to Atlassian Access until you've completed Step 6: Link your Enterprise to your organization.
Before you get started
To complete the steps in this guide, you’ll need to be the admin for both your Atlassian organization and your Trello Enterprise. If your company already has an Atlassian organization and you’re not an admin for it, you will need to coordinate with the Atlassian organization admin first. There will need to be at least one admin who can manage both the organization and the Enterprise.
If you’re not sure who the admin is for your Atlassian organization, contact the Trello Support team.
30-90 days before your renewal date
Step 1: Create an organization
- If you already have an Atlassian organization, skip this step and continue to Step 2: Verify your domains.
To subscribe to Atlassian Access, you’ll first need an organization. You can create an organization for free at https://admin.atlassian.com/o/create. Enter a name for your organization and click “Create”. You don't need to take any further action for this step.
Create a new organization in one step.
You will need to have an Atlassian account in order to create an organization. If you don’t already have one, you’ll have the opportunity to create one on the sign-in screen. Use the same email address for your Atlassian account that you use for your Trello account.
Step 2: Verify your domains
- If you’ve already verified all of the domains claimed by your Trello Enterprise—and any other domains you’ll be managing—in your Atlassian organization, you can skip this step and move on to Step 3: Claim your accounts.
To use SSO for your company’s domain, you’ll need to verify your ownership of that domain in your Atlassian organization. You can find step-by-step instructions on how to do that here.
Also, if you have any domains claimed in Trello, you’ll need to make sure that the same domains are claimed in your Atlassian organization. If you’re not sure which domains your Trello Enterprise has claimed, contact the Trello Support team for assistance.
Step 3: Claim accounts
- If users on your domain are already managed by your Atlassian organization, then you don’t need to take any action until 30 days before your renewal date, at which point you’ll move on to Step 4: Start an Atlassian Access trial.
Once you’ve verified ownership of your company’s domain, you’ll be able to claim all users on the domain.
If your Trello users' accounts are already managed by your Enterprise, either through a Trello domain claim or an account transfer link, then completing this step will not impact these users. You can go ahead and claim the users on your domain and proceed to Step 4.
How can I tell if my Trello users are managed by my Enterprise?
There are two places to find your managed users in your Trello Enterprise dashboard:
- On the “Enterprise members” page, managed users will have their email address listed beneath their name.
- On the “Free managed accounts” page, all users listed are managed by your Enterprise but not currently part of any Enterprise Workspace.
When you complete Step 3, the accounts that are not owned by your Enterprise will be claimed by your Atlassian organization. At this point, these users will be migrated to an Atlassian account and will need to use their Atlassian account to log into Trello. If SSO is not yet set up for your Atlassian organization, then these users will not be able to log in with SSO and will need to log in with an email address and password using their Atlassian account instead. Once they’re logged in, they should be able to continue using Trello without any other changes.
You can tell if an account is not owned by your Enterprise because you’ll see the words “ Not managed” beneath the user’s name in the “Enterprise members” page in your Enterprise admin dashboard in Trello, instead of their email address. These accounts will not appear in the “Free managed accounts” page.
If you want to make sure that these users are able to use SSO as soon as they’ve migrated to Atlassian account, you can skip this step for now and come back to it after you’ve completed Step 5: Set up SSO.
When you claim the accounts on your domain, this will include anyone using eligible Atlassian cloud products, even if they’re not using Trello. These users will be included in the bill for your Access subscription. They will not impact your Enterprise bill.
Deactivated Trello accounts:
Accounts that are deactivated in the Enterprise will still have an Atlassian account created and be considered billable with Access. Enterprise deactivation releases a license and prevents access to Enterprise content, but it doesn't deactivate the account entirely. To make those accounts non-billable they must be deactivated in the Atlassian Organization.
4 weeks before your renewal date
Step 4: Start an Atlassian Access trial
- If you already have an Atlassian Access subscription, skip this step and continue to Step 5: Set up SSO.
Go to https://www.atlassian.com/software/access and click on the “Get started” button to begin a 30-day free trial of Atlassian Access. You won’t need to enter any credit card information to start the trial.
If you do not already have an Atlassian Access subscription, we recommend waiting until you are within 30 days of your Enterprise renewal date before you start the trial.
If you don't plan on using SSO or other Atlassian Access features, you can skip to Step 6: Link your Enterprise to your organization.
Step 5: Set up SSO
If you already have SSO enabled for your Atlassian organization:
If your SSO configuration for Atlassian Access is using the same IdP (e.g., Okta, Azure, Idaptive, etc.) that your Trello Enterprise is using, then you’re all set. If you’re using a different IdP, you’ll need to add your Trello users to that IdP before you move on to the next step.
If you do not have SSO enabled for your Atlassian organization:
Detailed instructions for setting up SSO with Atlassian Access can be found here.
A note about user provisioning:
Provisioning via SCIM is supported for Enterprises that are linked to an Atlassian organization with an Atlassian Access subscription (see Step 6 below). If you're currently using your IdP to provision new Trello users via SCIM, you’ll need to set up provisioning for “Atlassian Cloud” in your IdP in order to continue creating new accounts this way.
2 weeks before your renewal date
Step 6: Link your Enterprise to your organization
Once you’ve confirmed that you’ve completed the steps above, go to the “Atlassian settings” tab on your Trello Enterprise admin dashboard. On this page, you’ll see an option to link your Enterprise to your Atlassian organization. Note that you will need to be an admin for both the Trello Enterprise and the Atlassian organization in order to link them.
The Atlassian Settings page will list any Atlassian organization that you're a member or admin of.
What if I don't see my organization listed?
If you've already created an organization but are not seeing any organizations listed on this page, your Trello account may not be connected to your Atlassian account yet. In this case, you should see a prompt inviting you to update your account. Click on the green "Update account" button to complete this process. Then, you should be able to see your organization.
This is what you can expect to see if your account needs to be updated.
Once you click on the “Link organization” button and confirm, your Enterprise will begin using the verified domains from your Atlassian organization for any feature requiring domain ownership. The Trello users on your claimed domain(s) will be prompted to migrate to an Atlassian account and will log in using their Atlassian account in the future. If you’ve set up SSO for your Atlassian organization, then your Trello users will log in using SSO as you’ve configured it.
This is what you'll see when your Enterprise is successfully linked to an Atlassian organization.
Note that this step will only impact users who were previously blocked from migrating their accounts because they were managed by the Enterprise. Users who were not claimed by the Enterprise will have already been migrated to an Atlassian account.
Any users who were previously owned by your Enterprise but are not on a claimed domain will no longer be managed accounts, but they will remain on any Enterprise-owned Workspaces that they currently belong to.
Any Trello users who were managed by your Enterprise, but did not have an Enterprise license will now be included in your Access bill. Your licensed Trello users will not be included in your Access bill until your renewal date.
How do I verify my Atlassian Access SSO is working?
Your Atlassian Access SAML configuration applies as soon as you click Link on your Atlassian Settings page. Because we don't log out your users, you can use these steps to test SAML configuration while still making adjustments:
- Open a new incognito window in your browser.
- Log in from https://trello.com with an email address from one of your verified domains.
Confirm you are signed in correctly and have all the expected access.
For more troubleshooting on Access SAML login, please refer to https://support.atlassian.com/security-and-access-policies/docs/configure-saml-single-sign-on-with-an-identity-provider/
What will happen if I move to the new version of Enterprise without setting up SSO in Atlassian Access?
We allow a 30 day grace period after your move to the new version of Enterprise during which your Trello SSO and domain claims will still work. After 30 days, the SSO configuration and domain claims within Trello will be removed. If you are currently using SSO with Trello Enterprise and would like to continue to do so, we strongly recommend that you complete your SSO setup in Atlassian Access before you move to the new version of Enterprise or within 30 days afterward.
Why can't I find SSO Setup in the Enterprise admin dashboard anymore?
Once the enterprise license changes to the new version of Enterprise, the original SSO Setup tab under enterprise admin console will be removed. We won’t remove your actual SSO configuration within Trello until after the 30 day grace period described above, but it will be superseded during the linking process with Atlassian Access SSO. You can view your Atlassian organization's SSO configuration in admin.atlassian.com.
What will happen to my end users when I link my Enterprise to an Atlassian organization?
If your end users are already using Atlassian account for Trello, there will be no change.
If your end users are not using Atlassian account and are logged into Trello, they will see a message in Trello letting them know that your organization is now managing their account. Next, we'll prompt them to either set a new password for their new Atlassian account or log in with a single sign-on (SSO), depending on your organization's security settings.
If your end users are not using Atlassian account and are not logged into Trello, they will see a message next time they try to log in asking them to check their email. The email will let them know that your organization is now managing their account and will give them a special link to return to Trello, where they will need to either set a new password for their new Atlassian account or log in with single sign-on (SSO), depending on your organization's security settings.