Configure Atlassian Jira Cloud for the Next Generation API Data Protection

To configure Atlassian Jira Cloud for the Next Generation API Data Protection, follow the instructions below.

Prerequisites

Before configuring Atlassian Jira Cloud for the Next Generation API Data Protection, review the prerequisite.

• You require an Atlassian standard, premium or enterprise subscription plan.

  Also, ensure that you have the Jira product (standard, premium, or enterprise plan) installed in your Atlassian environment.

  

• An Atlassian site-admin account with the following permissions:

  Global Permissions: Administer Jira and Browse users and groupsProject Permissions: Browse Projects. Refer to manage-global-permissions and manage-project-permissions for more information.

  A few important points to note:
  – Netskope recommends to create a dedicated user account (with appropriate permission) exclusively for the Netskope integration. Revoking access to this account will break the integration with Netskope. Creating a dedicated user account will ensure that the integration with Netskope will not break due to an exiting employee, and consequently a deactivation of the account.
  – Netskope can only access resources that are accessible by this service account. For example, if a page restriction prevents the service account from viewing a Confluence page, the page will not be scanned by Netskope
  – Do not use an Atlassian service account (the programmatic account type available in admin.atlassian.com) — these accounts lack an email inbox and cannot complete the OAuth authorization flow.
  – If SSO is enforced, note that the account must be placed in a non-SSO authentication policy (requires Atlassian Guard).
  – Ensure the account has a reachable email inbox, can log in interactively, is not tied to an individual employee, and holds the required global permissions.

• If you have guest or external users in your SaaS environment belonging to domains considered internal, you must set the appropriate internal domains for Netskope to classify exposure accurately. To set up internal domains, follow this article.

Configure Netskope to Access your Atlassian Jira Cloud Account

To authorize Netskope to access your Atlassian Jira Cloud account, follow the steps below:

1. Log in to the Netskope tenant UI and go to Settings > Configure App Access > Next Gen > CASB API.

2. Under Apps, select Jira and click Setup CASB API Instance.

   The Setup Instance window opens.

3. Under Site Domain, enter the fully-qualified domain name of the Atlassian account (example: mycompany.atlassian.net).

4. Under Administrator Email, enter the email address of the user who will receive an email notification when a policy violation or event triggers. This step is optional.

5. Under Instance Name, enter a name of the SaaS app instance. This step is optional and if left blank, Netskope will determine the name of the app instance post grant.

6. Click Grant Access.

   You will be redirected to the Atlassian sign-in page.

7. Login with the Atlassian site-admin account.

8. Review the permissions requested.

   To know more about the permissions, see Permissions Required for Atlassian Jira Cloud.

9. On the Authorize for: drop-down list, select the site domain you entered in step 3.

10. Click Accept.

    When the configuration results page opens, click Close.

Refresh your browser and you will see a green check icon next to the instance name.

You can receive audit events and standard user behavior analytic alerts in Skope IT. A list of audit events are available here. To know more: Next Generation API Data Protection Skope IT Events.

Important Points to Note

• No Public Exposure Detection: Next Generation API Data Protection cannot detect or enforce policies related to tickets, comments, or file exposures made public in Jira. This is due to restrictions in Jira’s upstream architecture that prevent visibility into such actions.