A beginner-friendly, permission-aware walkthrough for preparing Jira, adding the Microsoft 365 connector, testing one project, and troubleshooting common issues.
By Gowtham Rajamanickam · Updated September 11, 2026
Understand the two connection paths
Choose the path that matches the job you want to perform. The Microsoft 365 connector is intended for discovery and Copilot search. The optional flow is useful when an agent must call a Jira operation at run time.
| Use case | Connection | Credential | What happens |
|---|---|---|---|
| Microsoft 365 Copilot and Microsoft Search | Jira Cloud connector in the Microsoft 365 admin center | Standard OAuth | Microsoft authorizes the prepared Jira account, crawls selected content and applies source permissions. |
| Copilot Studio agent action | Jira connector in Power Platform or an Agent Flow | Atlassian API token + email | The flow calls Jira REST-backed actions such as Get issue by key (V2) when the agent runs. |
Prerequisites checklist
- ☐ Jira Cloud site URL, for example
https://your-site.atlassian.net. - ☐ Jira administration help for project permissions, issue security and profile visibility.
- ☐ Microsoft 365 administrator access to Copilot connectors.
- ☐ A small pilot project and at least two test users with deliberately different access.
- ☐ A test issue whose key and expected visibility are written down before indexing.
- ☐ Agreement on whether results must be restricted to existing Jira permissions.
- ☐ Network allowlists and REST/API access checked by the Jira administrator.
- ☐ A secure place for any API token used by the optional agent flow. Never place a token in a blog post, screenshot or prompt.
Microsoft’s current product requirements are described in the Jira Cloud deployment guide and the administrator setup guide.
Prepare Jira Cloud
- Copy only the Jira site root, such as
https://grajamanickam2024.atlassian.net. - Do not append
/browse/SCRUM-7,/rest/apior a project path. - Confirm the site opens over HTTPS from the network used by Microsoft services.
- Use a dedicated, named Jira account rather than a personal administrator account.
- Give it Jira product access and the minimum project permissions needed for the pilot.
- Allow project browsing and issue viewing for the selected project.
- Include issue-security permissions when protected issues are part of the test.
- Confirm that user/group lookup and email matching are permitted where required by your organization.
- Document the account owner, review date and offboarding process.
- Ask the Jira administrator to confirm that REST/API access is enabled.
- Review outbound allowlists, proxy rules and conditional access policies.
- Check whether Atlassian managed accounts restrict profile or email visibility.
- Record any restriction before troubleshooting the connector; otherwise a permission issue can look like an indexing failure.
Choose a project and test users
Use a small, repeatable test plan before selecting many projects.
- Choose one non-production project. In this walkthrough the project key is SCRUM and the project is “Gowtham’s Agile Team.”
- Choose one harmless issue, such as SCRUM-7, and record its title, status and expected audience.
- Nominate an authorized user who can browse the project and open the issue.
- Nominate a restricted user who cannot browse the project or cannot see the protected issue.
- Write down the expected result for each user before running Copilot tests.
| Test identity | Jira expectation | Copilot expectation |
|---|---|---|
| Authorized user | Can open SCRUM-7 in Jira | Can discover the issue and open the source link |
| Restricted user | Cannot open the issue or project | Issue should not be disclosed in results |
Configure the Microsoft 365 connector
- Sign in to the Microsoft 365 admin center.
- Open Copilot, then Connectors and Gallery.
- Search for Jira and select the Jira Cloud connector.
- Enter a clear display name, such as SCRUM pilot – Jira Cloud.
- Enter the Jira site root, not an issue URL.
- Accept only after confirming that the site and account are correct.
- Accept only after confirming that the site and account are correct.
- Accept only after confirming that the site and account are correct.
- Accept only after confirming that the site and account are correct.
- Choose OAuth 2.0 (Recommended) when it is offered.
- Select Authorize.
- Sign in to Atlassian with the dedicated connector account.
- Review the requested site and permissions.
- Accept only after confirming that the site and account are correct.
Understand the OAuth handshake
- Microsoft displays the Jira authorization page.
- You authenticate to Atlassian as the connector account.
- Atlassian asks you to approve the requested access.
- Atlassian returns an authorization result to Microsoft.
- Microsoft stores the connection securely and uses it for crawling.
- The connector account is the Jira identity used to read source content; it is not automatically the identity of every Copilot user.
- When source permissions are enabled, Microsoft uses identity matching to avoid showing content a user cannot access in Jira.
Use the Atlassian OAuth documentation for OAuth concepts and Microsoft’s Jira administrator guide for connector-specific settings.
- Accept only after confirming that the site and account are correct.
- Accept only after confirming that the site and account are correct.
- Accept only after confirming that the site and account are correct.
- Keep the pilot limited to the selected project.
- Choose source-permission-aware results when available.
- Check that Jira email addresses can be matched to Microsoft Entra identities.
- Use custom identity mapping only when the default match is not reliable.
- Keep the first crawl simple; add extra filters after the basic test passes.
- Select only the two pilot users or a small test group.
- Review the notice about indexing third-party data.
- Create the connection and monitor its status.
- Wait for the initial crawl before deciding that an issue is missing.
- Plan around incremental and full crawl timing; a permission change may not appear immediately.
Validate search and permissions
Start with a precise prompt that names the issue key and asks for a source link:
- Open the cited Jira link and compare the response with the source.
- Ask the same question as the authorized user and restricted user.
- Change a harmless test description, wait for synchronization and repeat the query.
- Record the time, user, prompt and observed result.
| Check | Pass condition | If it fails |
|---|---|---|
| Connection | Connector status is healthy | Review OAuth account and Jira permissions |
| Content | Authorized user finds SCRUM-7 | Check project selection, crawl status and issue security |
| ACL | Restricted user cannot discover the issue | Review identity mapping and source permission settings |
| Freshness | Harmless edit appears after synchronization | Wait for the next crawl and inspect connector activity |
Optional: build a Copilot Studio agent flow
This section is separate from the Microsoft 365 connector. Use it when an agent must call Jira directly.
When an agent calls the flow → Get issue by key (V2) → Respond to the agent.
Create the API-token connection
- Open Power Apps or Copilot Studio and add the Jira connector.
- Choose API Token as the authentication type.
- Enter the Atlassian account email used to create the token.
- Paste the token once, then store it in the connection; do not paste it into an instruction.
- Enter the Jira site root, for example
https://grajamanickam2024.atlassian.net. - Create the connection and select the newer action version when the designer offers it.
| Field | Value for this example | Safety note |
|---|---|---|
| Connection name | Jira-Connectors |
Use a descriptive name |
| Authentication type | API Token |
This is for the Power Platform action, not standard OAuth |
| Username or Email | Your Atlassian account email | Do not publish it in screenshots |
| API token | Token generated in Atlassian security settings | Secret; rotate if exposed |
| Jira instance | https://grajamanickam2024.atlassian.net |
Use HTTPS and the site root |
Test the flow
- Use a known key such as
SCRUM-7in the action input. - Run the flow and confirm a successful status.
- Inspect the returned key, summary, status and link.
- Map only the fields needed by the agent’s response.
- If the action says “Please use the new version,” replace the old action with
Get issue by key (V2)and recreate the connection if necessary.
Get Issue By Key
Results
Troubleshooting
- “Sorry, I can’t respond” in Prompt Builder: Verify that the flow is published, the agent has access to it and the response step is connected.
- “Please use new version of Action”: Remove the legacy action and add the V2 Jira action with a current connection.
- “Invalid parameters”: Check the issue key format, use a real key such as
SCRUM-7, and select the correct Jira instance. - Projects returned but an issue is missing: Inspect issue security, project permissions, selected content and crawl completion.
- Authorized user sees nothing: Compare the Jira email with the Microsoft Entra sign-in identity and review custom mapping.
- Restricted user sees too much: Stop the rollout and review source-permission settings before adding more data.
- OAuth authorization fails: Confirm the site URL, connector account, network allowlist and required Jira permissions.
- API-token call fails: Verify the token has not expired or been revoked, and create a new connection instead of exposing the token again.
For connector-specific diagnostics, see Microsoft’s Jira Cloud troubleshooting guide.
Official references
- Microsoft: Deploy the Jira Cloud connector
- Microsoft: Jira Cloud administrator setup
- Microsoft: Jira Cloud troubleshooting
- Microsoft: Jira connector actions
- Atlassian: OAuth 2.0 (3LO)
- Atlassian: Manage API tokens
Independent tutorial with original explanations and example values. Microsoft, Microsoft 365, Copilot, Jira and Atlassian are trademarks of their respective owners. This article is not an official Microsoft or Atlassian publication.
No comments
Post a Comment