At this moment, when the SSO login fails, Atlassian customers have to reach out to Cloud Support so they can verify the logs in the backend to identify what is causing the failure. 

Suggestion

The logs are available in Atlassian backend, it would be ideal to expose those logs to the customer, perhaps in the Organization Audit Logs. 

For example, when the SAML certificate is incorrect, the following log is recorded in the backend: 

With this message available in the Audit Logs the customers themselves would have a good starting point to initiate their analysis.

Best Scenario

In the example above, the error was caused because the certificate had several occurrences of the control character \x0a, which requires a new line to be added to the certificate for each one of them. It would be excellent to have a mechanism to scan and spot that kind of specific issue and also display it in a more detailed error message.