System Architecture

Platform Hosting Model

Azure Sync runs exclusively on the Atlassian Forge platform. The application:

Is fully hosted and operated within Atlassian Cloud
Does not use Forge Remote
Does not rely on external hosting providers
Does not use third-party processing services

All execution and storage occur within the Forge runtime environment.

Data Flow

The application follows an outbound-only communication model.

Configuration Phase

Administrators configure imports via the Jira user interface.
Configuration data is stored securely in Forge-hosted storage.

Synchronization Phase

The application authenticates to Microsoft Azure using the client credentials flow.
Data is retrieved from:
- Azure Resource Manager APIs
- Microsoft Graph APIs
Retrieved metadata is processed within Forge.
Processed resource data is written to Jira Assets using the Assets REST API.

Network Characteristics

All communication to Azure is outbound from Forge.
There is no inbound connection from Azure to Jira.
No direct Azure-to-Jira communication exists.
No external middleware or proxy services are used.

Data Processing & Storage

Azure Resource Data

The application processes Azure resource metadata, including but not limited to:

Resource Sync Feedback Hub

This data is synchronized into Jira Assets as object schemas and attributes.

Sub-processors

Azure Sync itself does not use any third-party subprocessors.

The application runs exclusively on the Atlassian Forge platform. All execution, temporary processing, and storage (including configuration data and access tokens) occur within the Forge runtime environment.

Atlassian (as the Forge platform provider) may engage its own subprocessors to deliver the underlying Forge infrastructure. The current list of Atlassian’s subprocessors for Forge is publicly available here: List of Data Subprocessors | Atlassian

These subprocessors are governed by Atlassian’s Forge Data Processing Addendum. No customer Azure resource data or synchronized Assets objects are transferred to any third-party subprocessors outside of Atlassian’s controlled environment.

Important clarification regarding Azure:

The Azure data you retrieve (resource metadata, Entra ID objects, etc.) is fetched directly by the app using outbound API calls from Forge to Microsoft Azure Resource Manager and Microsoft Graph.
This data is never stored or processed by Microsoft as a subprocessor of Atlassian Forge.
Microsoft only acts as the source system (data provider), not as a subprocessor for your application’s data handling.
No Azure resource data is passed to or stored in any Atlassian subprocessor beyond what is required for normal Forge operation.

Optional Directory Synchronization

If enabled, directory information from Microsoft Entra ID may be processed, including:

Users
Groups
Devices
Service Principals

Personal data (users) elements may include:

Names
Email addresses
Job titles
Phone numbers
Device ownership references

Synchronized directory data is stored exclusively within the customer’s Jira environment.

Configuration Data Stored in Forge

The following configuration data is stored securely in Forge storage:

Tenant ID
Subscription IDs or full subscription flag
Azure Application (Client) ID
Client Secret
Scheduler interval
Schema mapping configuration
Job execution identifiers and counters

Forge storage is logically isolated per installation and managed by Atlassian.

Data Residency & Retention

Operational logs follow Atlassian Forge retention policies (typically up to 30 days).
Configuration data remains stored only while the application is installed.
Upon uninstall, the Forge uninstall hook deletes all application storage keys.
Synchronized data in Jira Assets remains under the customer’s control.

Written deletion confirmation can be provided upon request.

Authentication & Secret Management

Azure Authentication Model

Azure Sync uses:

Azure Client ID
Azure Client Secret
Tenant ID

Authentication is performed using the OAuth 2.0 client credentials flow.

Token Handling

Access tokens are short-lived.
Tokens are generated dynamically.
Tokens are not persistently stored.

Secret Storage

Secrets are stored in Forge secure storage:

Managed by Atlassian
Encrypted at rest
Accessible only within the application runtime context

Secret rotation is controlled by the customer in Azure. When a secret is rotated, the updated value must be provided in the configuration.

Atlassian Credential Handling

The application:

Does not collect Atlassian Personal Access Tokens (PATs)
Does not store API tokens
Does not store passwords
Does not use shared credentials

Authentication to Jira is handled exclusively by Forge’s built-in mechanisms.

Azure Permissions Model

Azure Sync follows a strict least-privilege model.

Azure Resource Manager

Requires read-level permissions such as:

Subscription read access
Resource read access

Microsoft Graph

Requires read-only permissions including:

User.Read.All
Group.Read.All
Device.Read.All

Permissions may be scoped by the customer to:

Specific subscriptions
Resource groups
Tenants

Operational Restrictions

Azure Write Operations

The application operates strictly in read-only mode:

Performs GET operations only
Does not create resources
Does not update resources
Does not delete resources

No modifications are made to customer Azure environments.

Logging & Monitoring

Logged Information

The application logs:

Import execution status
Error messages
Job identifiers

Logging Safeguards

Logs do not contain synchronized Azure resource data.
Logs do not contain end-user content.
Logs remain within Atlassian infrastructure.
No external logging providers are used.

Account Security Controls

The following controls are enforced for development and support operations:

No shared accounts
No shared credentials
Mandatory Multi-Factor Authentication (MFA)

MFA applies to:

Atlassian accounts
Code repositories
Developer consoles

Incident Response

Detection

Security incidents are identified through:

Automated monitoring
Platform alerts
Customer reports

Notification

Customers are notified within 24 hours of confirmation of any security incident affecting customer data or systems.

Notification channels include:

Email
Support portal communication

Post-Incident Process

Root cause analysis
Preventive action planning
Escalation to senior technical leadership when required

Security Assurance & Compliance Alignment

Azure Sync is built entirely on Atlassian Forge infrastructure.

Atlassian maintains:

ISO 27001 certification
SOC 2 certification