Atlassian on Azure, inside a tenant that already sets the rules.
When Atlassian Data Center or its supporting services run on Azure, Atlas Bench deploys them into subscriptions governed by Azure Policy, ties sign-in and administration to Entra ID, and migrates work, repositories, and pipelines out of Azure DevOps into Jira and Bitbucket.
An Azure estate hands the Atlassian workload a directory, a policy model, and often a DevOps organization it is meant to replace. We build the deployment to fit the first two and plan the exit from the third.
What it is
An Azure tenant arrives with its mind made up. Entra ID already decides who signs in, Azure Policy already decides what may be deployed, and the engineering group frequently lives in Azure DevOps. A Jira or Confluence deployment that ignores any of those is either blocked by policy or bypassed by the people it was built for.
Where the nodes run is the smaller call: virtual machines, or AKS with Atlassian's Helm charts, backed by Azure Database for PostgreSQL and Azure Files for shared home. The bigger one is how the deployment behaves inside a tenant that was governed long before it arrived.
What it does
Entra ID is already authoritative
Signing in to Jira and Confluence and administering the subscription both resolve to one directory instead of two.
Policy is evaluated before anything deploys
A resource that breaks the tenant's Azure Policy assignments is denied, so the build is written to pass them rather than exempted from them.
Azure DevOps is usually what is being replaced
Boards, Repos, and Pipelines hold years of history and a permission model that has to land somewhere on purpose.
Where it fits
L2, platform and migration, governed from L1 and L3 in the same tenant. Entra ID holds the identities the deployment trusts, and Azure Policy holds the rules every resource underneath it must satisfy.
What we do with it
Deploying into a governed subscription
VMs or AKS, the database, and shared home, built to satisfy the tenant's policy assignments on the first run rather than after a string of exemptions.
Entra ID for sign-in and administration
SAML and SCIM into Atlassian through Atlassian Guard for users, and Entra role assignments for the people who operate the subscription.
Migrating out of Azure DevOps
Work items into Jira, repositories into Bitbucket, and pipelines rebuilt in Bitbucket Pipelines, with the permission model redesigned rather than copied across.
Keeping the guardrails honest
Policy exemptions granted during the build are reviewed and expired, so the estate stays inside the rules after the launch team leaves.
Where it earns its place
A Microsoft-standard enterprise adding Jira
Security will approve a deployment only if Entra controls access to it and Azure Policy allows every resource it creates.
An engineering group leaving Azure DevOps
Years of work items and repositories, and access that grew one exception at a time.