Jira Cloud M365 Copilot Connector access issues

[Asia]

Hello,
we have configured the Jira Cloud Microsoft 365 Copilot connector, based on this documentation: https://learn.microsoft.com/en-us/microsoft-365/copilot/connectors/jira-cloud-deployment. We have configured the "Only people with access to this data source" access level for this connector. Everything on the Jira side is configured correctly; our service account has "Administer Jira" and "Browse users and groups roles" assigned, a custom app with the described scopes is set up too, and the user UPN and email are the same. Other connector settings, like sync, are left at their default values. Our connection is up and running, and data is crawled according to the visible status in M365 admin > Copilot > Connectors, but we still have some user access issues. Some users can't access/ask about work items that they have access to in Jira via Copilot; they get "this item does not exist" or "I don't have access to this data" responses. The issue is random; users see some of the work items they have access to, while others do not - there is no discernible pattern here, and there are individual users for whom everything works flawlessly (e.g., for me). Users reporting the issue have the correct access permissions for Jira and their work items; they are able to access them manually.
Has anyone else encountered this problem and knows how to fix it?

[Cristian Quiroz Garcia - NTT DATA]

Hi @Asia! Based on the Microsoft Copilot connectors deployment documentation, this behavior is most likely caused by how permissions are synced.

Root cause: Incremental crawls don't sync permissions

From the official docs:

"Incremental crawls don't currently process updates to permissions."

And:

"A full refresh processes and indexes all changed items [...] Use a full refresh in scenarios such as: Detecting deleted items, Recovering from incremental crawl failures, Updating ACLs, Modifying crawl rules."

This means that between full crawls, any permission changes (project roles, group membership, issue security) are not picked up. Since full crawls run less frequently (daily by default), some users' ACLs may be stale — explaining why access appears "random" and inconsistent across users.

Workaround:

1. Go to M365 Admin Center → Copilot → Connectors → your Jira connection → Sync settings
2. Manually trigger a full crawl to force a complete ACL re-sync
3. Consider increasing the full crawl frequency (e.g., twice daily instead of once) if your permissions change often

Also check: Identity mapping

The connector maps Jira users to Entra ID by matching email to UserPrincipalName or Mail. If any affected user's Jira email doesn't exactly match their UPN or email in Microsoft Entra ID, the connector can't resolve their permissions. You can verify and configure a custom mapping formula under Custom setup → Users tab → Map Identities.

Hope this helps!

[Asia]

Hi, thanks for the answer. The issue is not even that the changes made in Jira are not being synchronized — it seems that the connector itself is unable to properly retrieve ACLs from the beginning.

Regarding identity mapping, our users have the same email address as their UPN.