/
[!] All you need to know as Jira administrator

[!] All you need to know as Jira administrator

All you need to know as Jira administrator

This guide is for Jira administrators who need to configure Microsoft 365 for Jira and want to understand the basics of the Microsoft ecosystem and what they need from their Microsoft 365 / Azure AD administrators. If you walk through this page, you should be "covered" for a standard rollout.

1. Compare Atlassian vs. Microsoft app concepts

Before you start, it helps to map familiar Atlassian concepts to the Microsoft world:

  • Atlassian OAuth 2.0 app → Microsoft Enterprise Application

    You may know Atlassian OAuth2 apps. They offer a secure way to login with Jira and provide Jira functionality outside of Jira.

    Microsoft equivalent: an Enterprise application in Azure Active Directory (Entra ID) controls which applications can provide a login with Microsoft.

  • Scopes / Permissions

    Atlassian OAuth 2 scopes define what the app can do on behalf of a user.

    Microsoft equivalent: API permissions (scopes) on the Enterprise app.

  • User‑based vs. App‑based permissions

    Atlassian OAuth 2 scopes are always evaluated in the context of the logged‑in user. App permissions that have access to all resources are only available for Forge/Connect apps.

    In Microsoft you have:

    • delegated (user‑based) permissions, the get a permission to act on behalf of the user. The app can do everything the user can for that specific permission. E.g. permission Mail.Read means, the app can read all mails of the user. These are the permissions our app uses the most, as it ensures the Microsoft permission model is in place.

    • application permissions, the app get permissions to do something tenant-wide. E.g. Mail.Read as application permissions would mean, that the app can read all mails of all users. By default we do not use these permissions, because the app is responsible for managing the permissions.

    • RSC (resource‑specific consent) which allow the app itself to act on a resource like a Teams chat or channel. The permissions is, as the name suggest, not tied to a user, but on a specific resource, like a specific Chat. The app then has full access to that chat independent of the users but not other chats in the tenant.

 

2. Get started

Now you know the basics, we can start.

After installation of the Jira app, there are 3 steps to be done:

  1. Configure Azure AD enterprise apps (required)

  2. Configure Teams apps

  3. Configure Outlook add-in

    (Update image)

image-20260119-120718.png

3. Configure Azure AD enterprise apps

This is the first and most important step. Without this, users cannot sign in with their Microsoft work accounts. In Microsoft Entra ID (formerly Azure AD), an Enterprise application is the tenant-specific instance of our app which controls who can sign in and which permissions/scopes are granted.

There are actually 2 different Enterprise Apps: One for Outlook Email, Calendar and Meetings and one for Microsoft Teams. If you want to utilize the full set of features, the Microsoft administrator needs to grant these steps for both apps.

3.1 What you need from the Microsoft administrator

You usually cannot create or fully configure the Enterprise app yourself unless you also have Entra ID admin rights. From the Microsoft 365 administrator you need the following:

  1. Create or locate the Enterprise application used by Microsoft 365 for Jira (based on our app registration or marketplace app instructions).

  2. Configure who can sign in:

    • Option A: allow sign‑in for all users in the tenant.

    • Option B: limit to specific users/groups (for pilot phases or controlled rollouts).

  3. Admin‑consent the scopes so users are not prompted individually (recommended).

There are different ways to manage the enterprise application. See Approve Microsoft 365 access for additional ways.

3.2 Result

Once the Enterprise app is in place and consented, almost everything in Jira will work – except Teams channel conversations, which require the extra Teams/RSC setup described below.

4. Teams app installation / RSC permissions

RSC scopes are not configured centrally in the Enterprise application UI alone. They are granted by installing the Teams app into the target chat or channel.

4.1 What actually happens when you install the Teams app

When the Microsoft 365 for Jira Teams app is installed into a chat or channel, Microsoft:

  • Associates the app with that specific chat or channel (the resource).

  • Grants the app the RSC permissions it requested for that resource.

Result:

  • The app can now manage that chat or channel as allowed by the granted scopes.

  • Jira can display and synchronize Teams conversations and perform actions such as posting messages in that chat or channel.

There is no Jira counterpart for this - The best analogy are app access rules . You can install an app into a specific Jira space and only then the app can access data within that space.

4.2 What you need from the Microsoft / Teams administrator

Depending on your organization’s policies, installing apps into Teams channels or chats might be restricted. If you as Jira admin cannot do this yourself, you need a Teams or Microsoft 365 admin to:

  1. Enable the Microsoft 365 for Jira Teams app in the tenant (if necessary).

  2. Install the app into the desired Teams channels and chats.

  3. Confirm that the app has the required RSC permissions for those resources.

Important: installing the app into the channel is what makes Teams channels and their conversations work with Jira. Without this, Jira can still work with Microsoft 365 in general, but Teams channel conversations will not be available.

 

Comments