Unable to deploy "Atlassian Confluence Audit (via Codeless Connector Platform)"data connector

[Hasan Fakher]

I am unable to deploy "Atlassian Confluence Audit (via Codeless Connector Platform)"data connector on Azure Sentinel.

Getting following error message:

Connectivity check failed. ConnectorId: ConfluenceAuditCCPPolling028dnd73-dj72-8dh3-8d73-10923373uenc, Status code:Unauthorized, Message:Call failed with status code 401 (Unauthorized): GET https://companyname.atlassian.net/wiki/rest/api/audit?startDate=1762495505090&endDate=176249580%E2%80%A6

I have created a service account on admin.atlassian.net. I have given service account "App Admin" permission to Confluence and Jira. I have also created an API Token on the service account and granted it read:audit-log:jira/read:audit-log:conflence scope.

When I go to "Atlassian Confluence Audit (via Codeless Connector Platform)" data connector on  Azure Sentinel and click on add organization, it asks for 3 details - organization url, service account email, and API Token. I am providing these details and made sure that service account have correct permission but I am still getting the error message that I have shared above.

Can someone please advise.

[Peter_DevSamurai]

Hi @Hasan Fakher ,

The 401 Unauthorized on the audit log endpoint (/wiki/rest/api/audit) is almost always a scope or permission problem. 

The Atlassian Confluence Audit (Codeless Connector) connector uses the old v1 audit log API (/wiki/rest/api/audit), and that endpoint does not respect the newer granular scopes like read:audit-log:confluence. It only works with the classic scope VIEW_AUDIT_LOG (or being a full Site Admin).

1) Use classic scopes (not granular) for the API token

When creating the API token for the service account:

• Go to https://id.atlassian.com/manage-profile/security/api-tokens
• Create token → Choose Classic scopes
• Add the scope VIEW_AUDIT_LOG (and VIEW_AUDIT_LOG for Jira if you also use the Jira Audit connector).

2) Make sure the service account is Site Admin (or Org Admin will do)

The v1 audit endpoint still requires Site Admin rights in many cases, even with the classic scope.

• Go to admin.atlassian.com → Directory → Users → find the service account → Groups → add it to site-admins (or make it Org Admin if you prefer). :)

3) This is optional but you can keep granular scopes for everything else

• You can have two tokens on the same service account: one with classic VIEW_AUDIT_LOG (used only for the Azure Sentinel connector) and another with your granular scopes for normal integrations.

After regenerating the token with the classic VIEW_AUDIT_LOG scope (and confirming Site Admin), go back to Azure Sentinel → Data connectors → Atlassian Confluence Audit → Add organization → paste the new token → it should pass the connectivity check.

I hope everything works out well for you!

Best,

Peter