How-To: Grant and Manage Access to Atlassian Rovo Using Allowlists

Summary

This article provides guidance on how Atlassian Organization Administrators can configure and restrict access to Atlassian Rovo using AI group allowlists when Default Rovo access is disabled. It outlines the underlying access evaluation model, step-by-step configuration instructions, and common configuration pitfalls (such as unexpected access).

Improper Rovo Access configuration can lead to unexpected access denials or unintended access across groups and sites.

Solution

Rovo Access Evaluation Logic:

• Access to Rovo is granted when a user is in an allow-listed AI group AND has access to an application/product where Rovo is enabled.

• The mapping is many-to-many (not 1:1 between specific groups and specific apps). If an app is listed and a user group is allow-listed, any user in that group who can access any of the enabled apps receives Rovo access.

A user is granted Rovo access if and only if both of the following conditions are met:

1. AI Group Allowlist: The user is a member of a group added to the Atlassian Intelligence / Rovo access policy allowlist.

2. Product Entitlement: The user has active product access to at least one product/site (e.g., Jira, Confluence, Jira Service Management) where Rovo is activated.

Many-to-Many Mapping (Critical Insight)

• Group allowlisting in Atlassian Administration applies across all sites/products in the organization where Rovo is enabled.

• It is not a 1:1 binding between a specific group and a specific site/app. If User A is in an allow-listed AI group for Team X, and User A also has product access to a separate site (e.g., a Sandbox or secondary Jira instance) where Rovo is turned on, User A will automatically have Rovo access in that secondary site as well.

Step-by-Step Guide: Configuring Rovo Allowlists

Step 1: Create or Identify the Target Pilot/Access Group

1. Navigate to admin.atlassian.com.

2. Go to Directory > Groups.

3. Create a dedicated group for Rovo users (e.g., rovo-pilot-users or ai-early-adopters) or identify existing functional groups (e.g., ai-team, ai-users).

4. Ensure target users are added to the designated group. 

Step 2: Configure AI & Rovo Feature Access Controls

1. In admin.atlassian.com, select Rovo > Rovo Access > Allowlist

2. Allow apps to access Rovo features

   1. Add an app to the Allowlist to enable access to Rovo features.

      1. Select Add. You’ll see a list of apps that have Rovo features.

      2. Select which apps to enable Rovo features for.

      3. Review your selection.

      4. Select Allow access to confirm.

3. Allow groups to access Rovo features

   1. Add a group to the Allowlist to enable access for those users.

      1. Users in these groups will only see Rovo features in apps that have also been added to the app allowlist.

      2. Select Add. You’ll see a list of your user groups.

      3. Select the groups to enable Rovo features access for.

      4. Review your selection.

      5. Select Allow access to confirm.

Step 3: Verify User Access Permissions

Individual User Check:

• Go to Directory > Users, select a test user, and verify both their Group memberships and App Access tabs.

• While logged in as the user, confirm that Rovo is accessible on the site/app.