# Integrating SailPoint with Atlassian Suite Cloud

Atlassian is a leading product company providing tools for collaboration and service desk. SailPoint's Atlassian Suite Cloud connector supports reading and provisioning of Atlassian users and groups. Use the Atlassian Suite Cloud source to manage Atlassian Suite user accounts. After it is successfully configured, your organization is able to aggregate and provision accounts for Jira users and manage access to other Atlassian Suite products such as Confluence and Jira Service Management by managing memberships of groups having access to the respective products.

This guide is designed to give specific information about the requirements and field definitions needed to get a working instance of the Atlassian Suite Cloud source.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The Atlassian Suite Cloud connector supports the features listed on this page.

> [!NOTE]
>
> Before you can use any feature marked with an asterisk (\*), SailPoint must activate the feature for your site.

### Account Management

- Aggregate accounts
- Add and remove entitlements
- \*Provision accounts

  - Create new accounts
  - Enable and disable managed accounts

    > **Note**
    >
    > Accounts must be claimed accounts from verified domains. For more information, refer to [Claim accounts](<https://support.atlassian.com/user-management/docs/verify-a-domain-to-manage-accounts/#Claim-accounts>) and [Verified domains in your organization](<https://support.atlassian.com/user-management/docs/verify-a-domain-to-manage-accounts/#Verified-domains-in-your-organization>) in the Atlassian documentation. Atlassian documentation is not managed by SailPoint and is subject to change without notice.
- \*Access Certifications (certification of entitlements connected to accounts)
- Multiple Group Objects and Direct Permissions
- Delete Accounts

For more information on features, refer to [Source Features](<https://community.sailpoint.com/knowledge/Identity-Security-Cloud-Source-Features>).

The following table lists the account feature details:

| Feature | Users |
| --- | --- |
| Aggregate | ✔ |
| Create | ✔ |
| Group Entitlements (Read, Request, Revoke) | Groups and Project Roles |
| Enable Direct Permissions | ✔ |

### Group Entitlements

Group Entitlements enable SailPoint to aggregate additional details from the managed system. These objects have a separate schema attribute definition list that the aggregation fetches when aggregation is run for that Group Entitlement type.

The following table lists the group feature details:

| Feature | Groups | Project Roles |
| --- | --- | --- |
| Aggregation | ✔ | ✔ |

> [!NOTE]
>
> We recommend not updating the group name, as the connector uses the name as the `identityAttribute` in the group schema. Changing the group name will cause the entitlement to be recreated and the old entitlement will be deleted.

## Supported Managed Systems

The SailPoint Atlassian Suite Cloud connector supports the following Atlassian products:

- Jira Software (Cloud)
- Jira Service Management
- Opsgenie
- Statuspage
- Confluence

> [!NOTE]
>
> The Jira Administrator can manage the Default Access group associated with different products. Users created from SailPoint are automatically assigned to the default Product Access Groups enabled on the managed system.

## Prerequisites

- Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).

  - Network Requirements

    Outbound access for port 443 (HTTPS) from the VA
- Whitelist the following URL on the VAs:

  `https://<domain>.atlassian.net` where `<domain>` is the domain name configured by the customer.

  `https://api.atlassian.com`
- The client is authorized using basic authentication which uses a Site Admin API Token. The token is encoded, and it is generated by user account with **Site Admin** access. It is added to headers for API requests.

  For more information on generating Site Admin API tokens, refer to [Manage API tokens for your Atlassian account](<https://support.atlassian.com/atlassian-account/docs/manage-api-tokens-for-your-atlassian-account/>) in the Atlassian documentation.

  > **Note**
  >
  > Atlassian API tokens don't use selectable scopes like OAuth scopes. They inherit the creator's Atlassian roles, so use an account with the required admin role when creating the token. Create the API token without a scope. The linked document is not maintained by SailPoint and is subject to change without notice.

  > **Screenshot**
  >
  > [![API Tokens](<https://documentation.sailpoint.com/connectors/atl_cloud/va/help/img/atl_suite_c_api_token.png>)](<https://documentation.sailpoint.com/connectors/atl_cloud/va/help/img/atl_suite_c_api_token.png>)
- Enabling or disabling accounts uses token authentication. It needs an Org Admin API Token generated by a user with **Org and Site Admin** access.

  For more information on generating API tokens, refer to [Manage an organization with the admin APIs](<https://support.atlassian.com/organization-administration/docs/manage-an-organization-with-the-admin-apis/>) in the Atlassian documentation.

  > **Note**
  >
  > Atlassian API tokens don't use selectable scopes like OAuth scopes. They inherit the creator's Atlassian roles, so use an account with the required admin role when creating the token. Create the API token without a scope.

  > **Screenshot**
  >
  > [![API key without scopes selection](<https://documentation.sailpoint.com/connectors/atl_cloud/va/help/img/atl_suite_c_before_you_begin.png>)](<https://documentation.sailpoint.com/connectors/atl_cloud/va/help/img/atl_suite_c_before_you_begin.png>)

### For Service Account Authentication

- The client is authorized using the email address of an Atlassian service account and a Service Account API Token. Use a scoped API token generated for a service account that has Jira product access and the required permissions. The token must include these classic scopes:

  - `read:jira-work`
  - `read:jira-user`
  - `manage:jira-configuration`
  - `manage:jira-project`

  For more information, refer to [Manage API tokens for service accounts](<https://support.atlassian.com/user-management/docs/manage-api-tokens-for-service-accounts/>).

## Required Permissions

- The service account must be a Site Admin User (Site Admin/ jira-administrators) with an API token created on the Atlassian Suite managed target system.
- To support enabling and disabling accounts, the service account must be a Org and Site Admin User with an Org Admin API token created on the Atlassian Suite managed target system.