nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Bug(?) with Microsoft 365 mailbox integration

Vilius Šumskas

Does anybody know how technically exactly Jira Service Management integrates with Microsoft 365 mailboxes? Which OAuth grant type is used and if it somehow tied to the machine the integration was set-up the first time?

We had a custom email address configured for at least couple of years now. It worked perfectly fine to this day, but today it started to produce Connection access token retrieval errors until it was rate limited by Jira itself. On Microsoft side the audit log for the mailbox said:

Failure reason: Device object was not found in the tenant '{tenantName}' directory.
Additional Details: Invalid grant due to the following reasons: - Requested SAML 2.0 assertion has invalid Subject Confirmation Method - Application On-Behalf-Of flow is not supported on V2 - Primary refresh token is not signed with session key - Invalid external refresh token - The access grant was obtained for a different tenant

The only thing that changed exactly at the same time errors started to appear was that my own PC was reinstalled and rejoined to Microsoft Azure AD. This is the same PC I set-up Microsoft email integration in Jira Service Management from.

Is this a bug or known limitation?

Accepted answers

Vilius Šumskas

OK, so after going back and forth with Atlassian support for a few months, and also contacting Microsoft support it is now officially confirmed as a limitation in the current JSM email integration implementation https://jira.atlassian.com/browse/JSDCLOUD-17480 .

In short, if JSM integration is configured from a device which is Microsoft Entra joined or Microsoft Entra Hybrid Joined, then issued refresh token will be device bound and will stop working if anything happens to the device object in the Entra ID. This is documented in official Microsoft documentation.

The workaround here is to use InPrivate or Incognito browser mode when configuring such JSM integration. InPrivate/Incognito mode will temporary negate Microsoft SSO effect and this way issued refresh token won't be bound to the device. I have confirmed that this workaround actually works.

Hope this helps somebody.

All comments

Marc -Devoteam-

HI @Vilius Šumskas

This error relates to to the Jira device object is not found or has been deleted from your Azure Tenant Entra ID, this is not an issue on the Jira side.

https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/app-integration/error-code-aadsts700003-device-object-not-found

https://support.atlassian.com/jira/kb/failure-to-connect-to-office365-mail-box-due-to-aadsts700003-device-object-was-not-found-in-the-tenant/

Vilius Šumskas

Yes I understand that the cause of the issue is that device object on MS side is deleted, but that's not the question I was asking.

The question is why the integration depends on some device object? Such integration should not be tied to any one user device. It's an integration between MS and Jira itself, not between MS, Jira and my PC. My PC doesn't even have that mailbox configured.

It's clearly something buggy on the OAuth implementation side.

Marc -Devoteam-

Hi @Vilius Šumskas

Your PC has nothing to do with the integration

Entra ID uses this in its terminology, this is not your device. The Device ID is an ID

So don't read the word device as your PC.

"A device identity is an object in Microsoft Entra ID. This device object is similar to users, groups, or applications. A device identity gives administrators information they can use when making access or configuration decisions."

Vilius Šumskas

Device ID is exactly that, a pointer to the Computer/Mobilephone/Tablet/whatever object in the Entra (ex-Azure AD).

I have confirmed that M365 email integration in JSM is tied to the device you are configuring integration with a few moment ago. Steps to reproduce:

1. Install Windows VM and connect it to Entra ID.

2. Setup JSM custom email mailbox.

3. Go to MS Entra Portal and delete Windows VM object.

Result: JSM email integration stops working.

Anusha A

Hi @Vilius Šumskas

I have reviewed your question and the answers that followed. I believe we need to further collaborate internally with our experts, therefore, I created a support ticket on your behalf. Our experts will reach out to you shortly.

I wish you a great day ahead!

Regards,
Anusha A

Vilius Šumskas

Hope this helps somebody.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

cloud

jira-service-management-cloud

jira-service-management