Admin Enabled Authentication for synced Teamwork Graph connectors

Admin Enabled Authentication lets organization admins allow users to see results from supported synced Teamwork Graph connectors without connecting their own account to the third-party app first.

Rovo still respects each user's existing permissions. Users only see content they are allowed to access in the connected app.

The connector setting is called Allow users to see results without connecting their account.

Where Admin Enabled Authentication applies

Admin Enabled Authentication applies when Rovo reads content from the Teamwork Graph, including Rovo Search, Chat, and Agents.

It does not apply to tools and actions that act in a third-party app. Tools and actions still require each user to connect and authenticate with their own account, because they act on that user's behalf.

Smart Link connectors and other non-synced connectors are not covered by this setting. Users still need to connect their own account for those connectors.

Supported connectors

Each supported connector has a permission freshness threshold: the maximum time a permission change in the third-party app may take to be reflected in Rovo. Changes are usually reflected sooner; the threshold is the outer bound Rovo holds itself to.

What happens if permissions are not current

For connectors with a permission freshness window, Rovo checks that permission updates from the connected app are received and applied within that window.

If Rovo cannot confirm that a connector's permissions are complete and current, results from that connector stop appearing in Rovo Search, Chat, and Agents until permissions can be confirmed again.

Results return automatically when syncing recovers. No admin or user action is needed.

Salesforce works differently. Salesforce permissions are validated for each query, so a permission freshness window does not apply.

What users see

When the setting is on, matched users can see results from the connector without a separate connection step. Results are limited to content they are permitted to see.

Users may still be prompted to connect their own account when:

• the connector does not support Admin Enabled Authentication

• the setting is off for that connector

• Rovo cannot match the user's Atlassian account to their third-party account

• the content is excluded for that connector, such as OneDrive files or Microsoft Teams direct messages

• the user wants to use tools or actions that act in the third-party app

Turn Admin Enabled Authentication on or off

The setting is controlled per connector. You can turn it on for some supported connectors and leave it off for others.

組織の管理者になる必要があります。

1. アトラシアンの管理に移動します。

2. 複数の組織がある場合は、対象の組織を選択します。

3. Select Connectors.

4. Select the supported synced connector you want to change.

5. Open the connector's settings.

6. Turn Allow users to see results without connecting their account on or off.

7. 変更を保存します。

When the setting is on, matched users may see that connector's results in Rovo Search, Chat, and Agents without connecting their own account.

When the setting is off, users connect their own account before they see results from that connector.

How identity matching works

To show results without each user connecting their own account, Rovo needs to match each Atlassian user to their account in the third-party app.

Rovo matches users in one of two ways, depending on the connector and your setup:

• Identity provider matching: If your organization uses a supported identity provider, such as Microsoft Entra ID or Okta, Rovo maps each user's Atlassian identity to their third-party identity through that provider.

• Email matching: Rovo matches users by corporate-domain email address when the user's Atlassian email address matches their account in the third-party app.

If Rovo cannot match a user, that user is not shown results automatically. They are prompted to connect their account directly instead.