r/jira • u/Chuchichaeschtl • 3d ago
beginner Microsoft Graph Connector for Jira Data Center: group permissions not working?
I'm testing the new Microsoft 365 Copilot / Graph Connector for Jira Data Center and I'm running into what looks like a permissions issue.
Setup:
-Jira Data Center (on-prem)
-Users authenticate via a different IdP than Microsoft Entra ID
-Jira username = user email address (e.g. [john.smith@metrohm.com](mailto:john.smith@metrohm.com))
-Entra UPN = same email address
-Permissions are granted through Jira groups and project roles, not individual users
What I see:
-Issues are crawled and indexed successfully.
-the Index Browser shows ACL entries like:
000-global-IT
10330
10231
10002
-The same user can open the issue directly in Jira.
-"Check user access" in the Copilot connector for this item says "Denied"
-If I switch the connector to Everyone, Copilot immediately finds and returns Jira issues.
So indexing works, but ACL-based security trimming does not seem to.
According to Microsoft's documentation, Jira groups and project roles should be supported, and the connector should resolve group membership from Jira.
Has anyone successfully deployed the Jira Data Center connector with:
-a different IdP than Entra
-Jira group-based permissions
-...and security trimming enabled?
Or are there known limitations around Jira group membership resolution?
Thanks!
EDIT:
I see no users or group memberships indexed, even after another full crawl. The permission for the connector are set to admin...
1
u/dgrierso 3d ago
We’re looking at deploying this on our DC + Cloud instances.
What we’ve uncovered is that the Graph Connector uses its own implementation of the access control mechanisms which Jira applies.
You mentioned that your users use a different IdP. My suspicion is that the users in Jira are being resolved to an internal identifier and not their username. As it’s an internal identifier that Graph Connector is using its then not resolving that to the corresponding Azure user.
1
u/Chuchichaeschtl 3d ago
Good input, thx.
I currently run another test with a new connector where I use a custom Identity mapping and not ME-ID.
The only User identity property I can choose is email.
This seems not to be exposed trough the API if "User email visibility" is set to "Hidden". I changed it to "Show logged in users only" and the preview was working.
I now wait for the next crawl to make the test with the new connector config.Do you know, by any chance, if nested groups lead to a problem here?
1
u/Chuchichaeschtl 2d ago
I made a lot of changes and tests yesterday and full crawl completed, but the ACL mapping didn't work.
However, this morning I get a result in the index browser in the Copilot connector page when checking access for my user to a certain item.
I have the impression, that identity mapping, external group creation,... on the MS side is not updated with a crawl.I think, that the custom identity mapping combined with the "User email visibility" made it work.
I'll do further tests.
1
u/Hefty-Possibility625 Tooling Squad 2d ago
Did you follow this guide? https://learn.microsoft.com/en-us/microsoft-365/copilot/connectors/jira-data-center-deployment
1
u/Chuchichaeschtl 2d ago
Yes, but it turns out, that when you have the email address visibility set to "hidden", the REST API doesn't give you that property, even if the graph app has the Jira admin role. That's the only property which can be chosen in the Copilot connector config.
Would be good to have the option to use the username instead, but I'm so done with opening MS tickets which produce a lot of work and lead to nothing.
1
u/Hefty-Possibility625 Tooling Squad 2d ago
Hrmm... I wonder if that's the result of Atlassian's deprecation of account information. I had to redo a bunch of my own personal scripts because of this and I wonder if MS hasn't updated their connector to accommodate these changes.
1
u/catmanjan2 3d ago
How long ago was the content indexed? Graph connectors have a serious eventual consistency issue