Administrate API token activity

[Varvara]

Hello, everyone!

I have a question. There are several ways to create different tokens. And I’m interested in a moment, I have users on the test account and they created user tokens. As an administrator, I wanted to see information about the Insights-> Api tokens activity. But I don’t see anything, not even the administrative token that I issued myself. User accounts aren’t managed. I have all the products in a free trial and all the premium. I would appreciate it if someone could bring this up and also wanted to clarify how to block the ability for users to create personal tokens, and how to issue them as an admin. Thank you!

[Amal Johnson]

Hello @Varvara ,

If you're already in cloud environment, in the admin portal under Security --> user security, you have option to create "Authentication" policies where you can set restrictions on Token creation for local directory users or managed account users. 

[Ugnius Aušra]

Hey @Varvara 

First of all, you can't see activity of unmanaged user accounts, outside your organization.

If you are organization admin, yes you can still track what those users are doing in your organization.

Second, for such a insights there's App called - Atlassian Guard.

Org admin, can't create token for user and block them from creating.

You can revoke access, if those accounts are managed, but no more.

Also all my experience is from Atlassian Cloud, so if you are working on Data Center, it can be different.

[Arkadiusz Wroblewski]

Hello @Varvara 

Insights → API token activity only shows tokens for managed accounts. Since your users are not managed, their personal API tokens will not appear there. It also does not cover every other token type, such as org admin API keys or service account tokens.

Also, admins cannot create a personal API token for another user. Those have to be created by the users themselves.

For external users, there is a separate API token access control, but that is about whether their tokens can access your apps, not about centrally managing their personal tokens.

https://support.atlassian.com/security-and-access-policies/docs/available-external-user-security-settings/