An organization uses SAML SSO with a custom identity provider. After rotating the IdP signing certificate, users report they cannot log in to Atlassian Cloud. The SAML response is signed with the new certificate. What is the most likely cause?

The SAML attribute mapping is broken.

The new certificate was not uploaded to the Atlassian SAML configuration.

The user accounts are locked out.

The IdP metadata URL is incorrect.

An organization uses SAML SSO with an IdP that sends group membership in the SAML assertion. They want to automatically grant access to a specific Atlassian Cloud product based on group membership. What is the correct way to achieve this?

Use the IdP to directly assign product access.

Manually add users to product access groups.

Create a rule in Atlassian Cloud to parse the SAML assertion.

Map the group attribute in SAML to Atlassian Cloud groups, then use those groups to control product access.

Why is it important to update the SAML certificate in Atlassian Cloud before the current certificate expires?

To prevent SSO failures for users when the IdP starts signing assertions with the new certificate.

To ensure the IdP can encrypt user passwords in transit.

To enable automatic user provisioning.

To allow Atlassian Cloud to generate new user passwords.

A company has SAML SSO configured. Users can log in, but they are not automatically redirected back to the Atlassian product after authentication; instead, they land on the IdP's dashboard. What is the most likely cause?

The user's browser is blocking cookies.

The SAML response is not signed.

The IdP is configured for IdP-initiated SSO only.

A company uses SAML SSO with Azure AD. They notice that when users log in, their display names are not updated in Atlassian Cloud, even though they changed their names in Azure AD. What is the most likely reason?

Atlassian Cloud does not support display name updates via SAML.

The SAML attribute mapping does not include the display name attribute.

The SAML certificate has expired.

The users are not assigned to the Atlassian app in Azure AD.

AtlassianCloud Organization Admin

Domain 2Objective 2

Configure SAML Single Sign-On ACP-520 Practice Questions (Page 3)

Part of the Atlassian Access and Authentication domain, which makes up ~44% of our current practice bank. Atlassian does not publish an official question count, but from its 90-minute exam (~35–60 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

6concepts

Questions 11–15

11application · medium
An organization uses SAML SSO with a custom identity provider. After rotating the IdP signing certificate, users report they cannot log in to Atlassian Cloud. The SAML response is signed with the new certificate. What is the most likely cause?
Select an answer first
12expert · hard
An organization uses SAML SSO with an IdP that sends group membership in the SAML assertion. They want to automatically grant access to a specific Atlassian Cloud product based on group membership. What is the correct way to achieve this?
Select an answer first
13foundation · easy
Why is it important to update the SAML certificate in Atlassian Cloud before the current certificate expires?
Select an answer first
14expert · hard
A company has SAML SSO configured. Users can log in, but they are not automatically redirected back to the Atlassian product after authentication; instead, they land on the IdP's dashboard. What is the most likely cause?
Select an answer first
15application · medium
A company uses SAML SSO with Azure AD. They notice that when users log in, their display names are not updated in Atlassian Cloud, even though they changed their names in Azure AD. What is the most likely reason?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACP-520

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Atlassian. “ACP-520” is a trademark of its owner, used for identification only.