Problem Definition

In enterprise environments with strict identity governance and multi-factor authentication mandates (SAML SSO enforcement via CAC/PKI / Keycloak), all user identities must be provisioned and authenticated exclusively through centralized Identity Providers or external directories (LDAP/Crowd).

Currently, System Administrators and Administrators in Bitbucket Data Center can still manually create local user accounts with standard username and password credentials within the default Internal Directory.

While administrators can hide the internal login form from the UI and disable basic authentication for API calls, there is no native configuration or policy toggle to prevent administrators from provisioning local username/password accounts in the Internal Directory while keeping the directory enabled.

Suggested Solution

Introduce a native administrative toggle or policy setting to:

• Restrict/disable the ability for Administrators to create new local users in the Internal Directory when multi-factor authentication mandates are enabled(SAML SSO enforcement via CAC/PKI / Keycloak).

 Impact

• Bypassing centralized IdP controls (CAC/PKI multi-factor authentication) via local account creation creates compliance and security policy violations.
• * Eliminates the risk of shadow administrative/local accounts being provisioned outside centralized identity lifecycle management workflows.