...

In any case, we always recommend keeping at least one superadmin user in the Internal Directory using a strong password, so that you can easily get back in case your SSO integration fails (certificate expiry, URL, and tenant changes, and so on).

A note about cloud user provisioning and passwords

When you set up user provisioning from cloud user databases as described above (either via SCIM or API Connectors) users will not have their passwords synced. This means that these users are not able to use their passwords locally in Jira, Confluence, Bitbucket and Bamboo, which is no problem when you set up login using SAML, OIDC or Kerberos, but it will naturally not work to use username/password login locally in the Atlassian products.

Git operations for users created via cloud user provisioned

As described in the above section users created via cloud user provisioning will not have a local password. Therefore, such users that want to do git operations against Bitbucket will not be able to authenticate with username and password. The way to authenticate from git is therefore by using SSH keys as is built in support for in Bitbucket. A guide from Atlassian on how each user can create his SSH key is found here:

https://confluence.atlassian.com/bitbucketserver/ssh-user-keys-for-personal-use-776639793.html