Blog Post

Apps on Azure Blog
12 MIN READ

Get started with Atlassian Rovo MCP server in Azure SRE Agent

dbandaru's avatar
dbandaru
Icon for Microsoft rankMicrosoft
Feb 25, 2026

Get started with Atlassian Rovo MCP server in Azure SRE Agent

Connect Azure SRE Agent to Jira, Confluence, Compass, and Jira Service Management using the official Atlassian Rovo MCP server.

Overview

The Atlassian Rovo MCP server is a cloud-hosted bridge between your Atlassian Cloud site and Azure SRE Agent. Once configured, it enables real-time interaction with Jira, Confluence, Compass, and Jira Service Management data through natural language. All actions respect your existing Atlassian user permissions.

The server supports API token (Basic or Bearer auth) for headless or automated setups. Azure SRE Agent connects using Streamable-HTTP transport directly to the Atlassian-hosted endpoint.

Key capabilities

ProductCapabilities
JiraSearch issues with JQL, create/update tickets, add comments and worklogs, transition issues through workflows
ConfluenceSearch pages with CQL, create/update pages and live docs, manage inline and footer comments
CompassCreate/delete service components and relationships, manage custom fields, query dependencies
Jira Service ManagementQuery ops alerts, view on-call schedules, get team info, escalate alerts
Rovo SearchNatural language search across Jira and Confluence, fetch content by ARI

[!NOTE] This is the official Atlassian-hosted MCP server at https://mcp.atlassian.com/v1/mcp. The server exposes 46+ tools across five product areas. Tool availability depends on authentication method and granted scopes.


Prerequisites

  • Azure SRE Agent resource deployed in Azure
  • Atlassian Cloud site with one or more of: Jira, Confluence, Compass, or Jira Service Management
  • User account with appropriate permissions in the Atlassian products you want to access
  • For API token auth: Organization admin must enable API token authentication in the Rovo MCP server settings

Step 1: Get your Atlassian credentials

Choose one of the two authentication methods below. API token (Option A) is recommended for Azure SRE Agent because it enables headless configuration without browser-based flows.

API token authentication allows headless configuration without browser-based OAuth flows—ideal for Azure SRE Agent connectors.

Navigate to the API token page

  1. Log in to your Atlassian account
  2. Select your profile avatar in the top-right corner
  3. Select Manage account
  4. In the left sidebar, select Security
  5. Under the API tokens section, you can manage your existing tokens

Alternatively, use this direct link that pre-selects all MCP scopes:

Direct URL: Create API token with all MCP scopes

Create the token

  1. Navigate to the Atlassian API token creation page to create a token with all MCP scopes preselected
  2. Optionally click Back to manually select only the scopes you need (see Available scopes)
  3. Copy the generated token and note the email address associated with your Atlassian account
  4. Base64-encode your credentials:
# Format: email:api_token
echo -n "your.email@example.com:YOUR_API_TOKEN_HERE" | base64

On Windows PowerShell:

[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes("your.email@example.com:YOUR_API_TOKEN_HERE"))

This produces a base64-encoded string you'll use in the connector configuration as the Authorization: Basic <value> header.

[!IMPORTANT] Store the API token securely. It cannot be viewed again after creation. If lost, generate a new token from the same API tokens page.

[!NOTE] API token authentication must be enabled by your organization admin. If you cannot create a token, ask your admin to enable API token authentication in the Rovo MCP server settings at admin.atlassian.com > Security > Rovo MCP server.

Available scopes

The API token supports the following scope categories:

CategoryScopes
Jiraread:jira-work, write:jira-work, read:jira-user
Confluenceread:page:confluence, write:page:confluence, read:comment:confluence, write:comment:confluence, read:space:confluence, read:hierarchical-content:confluence, read:confluence-user, search:confluence
Compassread:component:compass, write:component:compass
JSMread:incident:jira-service-management, write:incident:jira-service-management, read:ops-alert:jira-service-management, write:ops-alert:jira-service-management, read:ops-config:jira-service-management, read:servicedesk-request
Bitbucketread:repository:bitbucket, write:repository:bitbucket, read:pullrequest:bitbucket, write:pullrequest:bitbucket, read:pipeline:bitbucket, write:pipeline:bitbucket, read:user:bitbucket, read:workspace:bitbucket, admin:repository:bitbucket
Platformread:me, read:account, search:rovo:mcp

[!NOTE] Bitbucket scopes are available in the token, but Bitbucket tools are not yet listed on the official supported tools page. Bitbucket tool support may be added in a future update.


Step 2: Add the MCP connector

Connect the Atlassian Rovo MCP server to your SRE Agent using the portal.

Using the Azure portal (API token auth)

  1. In Azure portal, navigate to your SRE Agent resource
  2. Select Builder > Connectors
  3. Select Add connector
  4. Select MCP server (User provided connector) and select Next

Select "MCP server" as the connector type in the Add a connector dialog

  1. Configure the connector:
FieldValue
Nameatlassian-rovo-mcp
Connection typeStreamable-HTTP
URLhttps://mcp.atlassian.com/v1/mcp
AuthenticationCustom headers
Header KeyAuthorization
Header ValueBasic <your_base64_encoded_email_and_token>
  1. Select Next to review

Configure the MCP server connector with the Atlassian endpoint URL and custom Authorization header

  1. Select Add connector

Connectors list showing atlassian-rovo-mcp with Connected status


Step 3: Create an Atlassian subagent

Create a specialized subagent to give the AI focused Atlassian expertise and better prompt responses.

  1. Navigate to Builder > Subagents
  2. Select Add subagent
  3. Paste the following YAML configuration:
api_version: azuresre.ai/v1
kind: AgentConfiguration
metadata:
  owner: your-team@contoso.com
  version: "1.0.0"
spec:
  name: AtlassianRovoExpert
  display_name: Atlassian Rovo Expert

  system_prompt: |
    You are an Atlassian expert with access to Jira, Confluence, Compass, and
    Jira Service Management via the Atlassian Rovo MCP server.

    ## Capabilities

    ### Jira
    - Search issues using JQL (Jira Query Language) with `searchJiraIssuesUsingJql`
    - Create, update, and transition issues through workflows
    - Add comments, worklogs, and manage issue metadata
    - Look up user account IDs and project configurations

    ### Confluence
    - Search pages and content using CQL (Confluence Query Language) with `searchConfluenceUsingCql`
    - Create and update pages and live docs with Markdown content
    - Add inline and footer comments on pages
    - Navigate spaces and page hierarchies

    ### Compass
    - Create, query, and delete service components (services, libraries, applications)
    - Define and manage relationships between components
    - Manage custom field definitions and component metadata
    - View component activity events (deployments, alerts)

    ### Jira Service Management
    - Query ops alerts by ID, alias, or search criteria
    - View on-call schedules and current/next responders
    - Get team info including escalation policies and roles
    - Acknowledge, close, or escalate alerts

    ### Cross-Product
    - Use Rovo Search (`search`) for natural language queries across Jira and Confluence
    - Fetch specific content by Atlassian Resource Identifier (ARI) using `fetch`
    - Get current user info and list accessible cloud sites

    ## Best Practices

    When searching Jira:
    - Use JQL for precise queries: `project = "MYPROJ" AND status = "Open"`
    - Start with broad searches, then refine based on results
    - Use `currentUser()` for user-relative queries
    - Use `openSprints()` for active sprint work

    When searching Confluence:
    - Use CQL for structured searches: `space = "ENG" AND type = page`
    - Use Rovo Search for natural language queries when JQL/CQL isn't needed
    - Consider space keys to narrow results

    When creating content:
    - Confirm project/space/issue type with the user before creating
    - Use `getJiraIssueTypeMetaWithFields` to check required fields
    - Use `getConfluenceSpaces` to list available spaces

    When handling errors:
    - If access is denied, explain what permission is needed
    - Suggest the user contact their Atlassian administrator
    - For expired tokens, advise re-authentication

  mcp_connectors:
    - atlassian-rovo-mcp

  handoffs: []
  1. Select Save

[!NOTE] The mcp_connectors field references the connector name you created in Step 2. This gives the subagent access to all tools provided by the Atlassian Rovo MCP server.


Step 4: Add an Atlassian skill

Skills provide contextual knowledge and best practices that help agents use tools more effectively. Create an Atlassian skill to give your agent expertise in JQL, CQL, and Atlassian workflows.

  1. Navigate to Builder > Skills
  2. Select Add skill
  3. Paste the following skill configuration:
api_version: azuresre.ai/v1
kind: SkillConfiguration
metadata:
  owner: your-team@contoso.com
  version: "1.0.0"
spec:
  name: atlassian_rovo
  display_name: Atlassian Rovo

  description: |
    Expertise in Atlassian Cloud products including Jira, Confluence, Compass,
    and Jira Service Management. Use for searching issues with JQL, creating
    and updating pages, managing service components, investigating ops alerts,
    and navigating Atlassian workspaces via the Rovo MCP server.

  instructions: |
    ## Overview

    Atlassian Cloud provides integrated tools for project tracking (Jira),
    documentation (Confluence), service catalog management (Compass), and
    incident management (Jira Service Management). The Atlassian Rovo MCP
    server enables natural language interaction with all four products.

    **Authentication:** OAuth 2.1 or API token (Basic/Bearer). All actions
    respect existing user permissions.

    ## Searching Jira with JQL

    JQL (Jira Query Language) enables precise issue searches. Always use
    `searchJiraIssuesUsingJql` for structured queries.

    **Common JQL patterns:**

    ```jql
    # Open issues assigned to current user
    assignee = currentUser() AND status != Done

    # Bugs created in the last 7 days
    project = "MYPROJ" AND type = Bug AND created >= -7d

    # High-priority issues in active sprints
    project = "MYPROJ" AND priority in (High, Highest) AND sprint in openSprints()

    # Full-text search
    project = "MYPROJ" AND text ~ "payment error"

    # Issues updated recently
    updated >= -24h ORDER BY updated DESC
    ```

    **JQL operators:** `=`, `!=`, `~` (contains), `in`, `>=`, `<=`, `NOT`, `AND`, `OR`

    **JQL functions:** `currentUser()`, `openSprints()`, `startOfDay()`,
    `endOfDay()`, `membersOf("group")`

    ## Searching Confluence with CQL

    CQL (Confluence Query Language) searches pages, blog posts, and attachments.
    Use `searchConfluenceUsingCql` for structured queries.

    **Common CQL patterns:**

    ```cql
    # Search by title
    title ~ "Architecture"

    # Search in specific space
    space = "ENG" AND type = page

    # Full-text content search
    text ~ "deployment pipeline"

    # Recently modified pages
    lastModified >= now("-7d") AND type = page

    # Pages by label
    label = "runbook" AND space = "SRE"
    ```

    **CQL fields:** `title`, `text`, `space`, `type`, `label`, `creator`,
    `lastModified`

    ## Creating Jira Issues

    Follow this workflow:
    1. `getVisibleJiraProjects` — list available projects
    2. `getJiraProjectIssueTypesMetadata` — list issue types for the project
    3. `getJiraIssueTypeMetaWithFields` — get required/optional fields
    4. `createJiraIssue` — create the issue

    Common issue types: Story, Bug, Task, Epic, Sub-task.

    ## Creating Confluence Pages

    Pages support Markdown content:
    1. `getConfluenceSpaces` — list available spaces
    2. `getPagesInConfluenceSpace` — optionally find a parent page
    3. `createConfluencePage` — create the page with space, title, and body

    ## Working with Compass Components

    Component types: SERVICE, LIBRARY, APPLICATION, CAPABILITY,
    CLOUD_RESOURCE, DATA_PIPELINE, MACHINE_LEARNING_MODEL, UI_ELEMENT,
    WEBSITE, OTHER.

    Relationship types: DEPENDS_ON, OTHER.

    ## Jira Service Management Operations

    For incident and alert management:
    - `getJsmOpsAlerts` — query alerts by ID, alias, or search
    - `updateJsmOpsAlert` — acknowledge, close, or escalate alerts
    - `getJsmOpsScheduleInfo` — view on-call schedules and responders
    - `getJsmOpsTeamInfo` — list teams with escalation policies

    ## Cross-Product Workflows

    - Use `search` (Rovo Search) for natural language queries across products
    - Use `fetch` with ARIs (Atlassian Resource Identifiers) for direct content retrieval
    - Use `getAccessibleAtlassianResources` to list cloud sites and get cloudIds

    ## Troubleshooting

    | Issue | Solution |
    |-------|----------|
    | JQL syntax error | Check field names; quote values with spaces |
    | CQL returns no results | Verify space key; try broader terms |
    | Cannot create issue | Verify "Create" permission in the project |
    | Cannot edit page | Verify "Edit" permission in the space |
    | OAuth expired | Re-invoke any tool to trigger fresh OAuth flow |
    | "Site admin must authorize" | Admin must complete initial 3LO consent |
    | cloudId errors | Use `getAccessibleAtlassianResources` to find correct cloudId |

  mcp_connectors:
    - atlassian-rovo-mcp
  1. Select Save

Reference the skill in your subagent

Update your subagent configuration to include the skill:

spec:
  name: AtlassianRovoExpert
  skills:
    - atlassian_rovo
  mcp_connectors:
    - atlassian-rovo-mcp

Step 5: Test the integration

  1. Open a new chat session with your SRE Agent
  2. Try these example prompts:

Jira workflows

Find all open bugs assigned to me in the PAYMENTS project

Create a new story in project PLATFORM titled "Implement rate limiting for API gateway"

Show me the available transitions for issue PLATFORM-1234

Add a comment to PLATFORM-1234: "Reviewed and approved for deployment"

Log 2 hours of work on PLATFORM-1234 with description "Code review and testing"

Confluence workflows

Search Confluence for pages about "incident response runbooks"

Show me the spaces I have access to

Create a new Confluence page in the Engineering space titled "Q3 2025 Architecture Review"

What pages are under the "Runbooks" parent page?

Compass workflows

List all service components in Compass

Create a new service component called "payment-gateway"

What components depend on the api-gateway service?

Show me recent activity events for the auth-service component

Jira Service Management workflows

Show me active ops alerts from the last 24 hours

Who is currently on-call for the platform-engineering schedule?

Acknowledge alert with alias "high-cpu-prod-web-01"

Get team info and escalation policies for the SRE team

Cross-product workflows

Search across Jira and Confluence for content related to "deployment pipeline"

What Atlassian cloud sites do I have access to?

Fetch the Confluence page linked to Jira issue PLATFORM-500

Available tools

Jira tools (14 tools)

ToolDescriptionRequired Scopes
searchJiraIssuesUsingJqlSearch issues using a JQL queryread:jira-work
getJiraIssueGet issue details by ID or keyread:jira-work
createJiraIssueCreate a new issue in a projectwrite:jira-work
editJiraIssueUpdate fields on an existing issuewrite:jira-work
addCommentToJiraIssueAdd a comment to an issuewrite:jira-work
addWorklogToJiraIssueAdd a time tracking worklog entrywrite:jira-work
transitionJiraIssuePerform a workflow transitionwrite:jira-work
getTransitionsForJiraIssueList available workflow transitionsread:jira-work
getVisibleJiraProjectsList projects the user can accessread:jira-work
getJiraProjectIssueTypesMetadataList issue types in a projectread:jira-work
getJiraIssueTypeMetaWithFieldsGet create-field metadata for a project and issue typeread:jira-work
getJiraIssueRemoteIssueLinksList remote links (e.g., Confluence pages) on an issueread:jira-work
lookupJiraAccountIdFind user account IDs by name or emailread:jira-work

Confluence tools (11 tools)

ToolDescriptionRequired Scopes
searchConfluenceUsingCqlSearch content using a CQL querysearch:confluence
getConfluencePageGet page content by ID (as Markdown)read:page:confluence
createConfluencePageCreate a new page or live doc with Markdown bodywrite:page:confluence
updateConfluencePageUpdate an existing page (title, body, location)write:page:confluence
getConfluenceSpacesList spaces by key, ID, type, status, or labelsread:space:confluence
getPagesInConfluenceSpaceList pages in a space, filtered by title/status/typeread:page:confluence
getConfluencePageDescendantsList descendant pages under a parent pageread:hierarchical-content:confluence
createConfluenceFooterCommentCreate a footer comment or reply on a pagewrite:page:confluence
createConfluenceInlineCommentCreate an inline comment tied to selected textwrite:page:confluence
getConfluencePageFooterCommentsList footer comments on a page (as Markdown)read:comment:confluence
getConfluencePageInlineCommentsList inline comments on a pageread:comment:confluence

Compass tools (13 tools)

ToolDescriptionRequired Scopes
getCompassComponentsSearch or list componentsread:component:compass
getCompassComponentGet component details by IDread:component:compass
createCompassComponentCreate a service, library, or other componentwrite:component:compass
deleteCompassComponentDelete an existing component and its definitionswrite:component:compass
createCompassComponentRelationshipCreate a relationship between two componentswrite:component:compass
deleteCompassComponentRelationshipRemove a relationship between two componentswrite:component:compass
getCompassComponentActivityEventsList recent activity events (deployments, alerts)read:component:compass
getCompassComponentLabelsGet labels applied to a componentread:component:compass
getCompassComponentTypesList available component typesread:component:compass
getCompassComponentsOwnedByMyTeamsList components owned by your teamsread:component:compass
getCompassCustomFieldDefinitionsList custom field definitionsread:component:compass
createCompassCustomFieldDefinitionCreate a custom field definitionwrite:component:compass
deleteCompassCustomFieldDefinitionDelete a custom field definitionwrite:component:compass

Jira Service Management tools (4 tools)

[!NOTE] JSM tools only support authentication via API token. These tools are available only if API token authentication is enabled by your organization admin.

ToolDescriptionRequired Scopes
getJsmOpsAlertsGet alert by ID/alias or search by query and time windowread:ops-alert:jira-service-management, read:ops-config:jira-service-management, read:jira-user
getJsmOpsScheduleInfoList on-call schedules or get current/next respondersread:ops-config:jira-service-management, read:jira-user
getJsmOpsTeamInfoList ops teams with escalation policies and rolesread:ops-config:jira-service-management, read:jira-user
updateJsmOpsAlertAcknowledge, unacknowledge, close, or escalate an alertread:ops-alert:jira-service-management, write:ops-alert:jira-service-management

Rovo / Shared platform tools (4 tools)

ToolDescriptionRequired Scopes
searchNatural language search across Jira and Confluence (not JQL/CQL)search:rovo:mcp
fetchFetch content by Atlassian Resource Identifier (ARI)search:rovo:mcp
atlassianUserInfoGet current user details (account ID)read:me
getAccessibleAtlassianResourcesList accessible cloud sites and their cloudIdsread:account, read:me

Troubleshooting

Authentication issues

ErrorCauseSolution
401 UnauthorizedInvalid or expired API tokenGenerate a new token at id.atlassian.com
403 ForbiddenMissing product permissionsVerify you have access to the Atlassian product (Jira, Confluence, etc.)
"Your site admin must authorize this app"First-time setup requires adminA site admin must complete initial 3LO consent
"Your organization admin must authorize access from a domain"Domain not allowedAdmin must add the domain in Rovo MCP server settings
"You don't have permission to connect from this IP address"IP allowlisting enabledAdmin must add your IP range to the allowlist
API token auth failsFeature disabled by adminAdmin must enable API token authentication

Data and permission issues

ErrorCauseSolution
No data returnedWrong cloudId or expired sessionUse getAccessibleAtlassianResources to find the correct cloudId
Cannot create issueMissing project permissionVerify "Create" permission in the Jira project
Cannot update pageMissing space permissionVerify "Edit" permission in the Confluence space
Tool not availableMissing scopesRe-create API token with required scopes
Compass tools unavailableScopes not available for API tokensSome Compass tools require OAuth 2.1
JSM tools not workingAPI token auth disabledAdmin must enable API token authentication

Verify the connection

Test the server endpoint directly:

# Test with API token (Basic auth)
curl -I https://mcp.atlassian.com/v1/mcp \
  -H "Authorization: Basic <your_base64_encoded_credentials>"

# Test with service account (Bearer auth)
curl -I https://mcp.atlassian.com/v1/mcp \
  -H "Authorization: Bearer <your_api_key>"

Expected response: 200 OK confirms authentication is working.

Re-authorize the integration

If you encounter persistent issues:

  1. Go to id.atlassian.com/manage-profile/apps
  2. Find and revoke the MCP app authorization
  3. Generate a new API token or re-invoke a tool to trigger fresh OAuth flow

Limitations

LimitationDetails
Limited tool availability with API tokensSome tools (e.g., certain Compass tools) may not be available because required scopes aren't available for API tokens
No bounded cloudIdAPI tokens are not bound to a specific cloudId. Tools must explicitly pass the cloudId where needed
No domain allowlist validationAPI token auth doesn't use OAuth redirect URIs, so domain allowlist checks cannot be performed
Bitbucket toolsBitbucket scopes are available in the token, but Bitbucket tools are not yet listed as supported
JSM requires API tokenJira Service Management tools only work with API token authentication, not OAuth 2.1

Security considerations

How permissions work

  • User-scoped: All actions respect the authenticated user's existing Atlassian permissions
  • Product-level: Access requires matching product permissions (Jira, Confluence, Compass)
  • Session-based: OAuth tokens expire and require re-authentication; API tokens persist until revoked

Admin controls

Atlassian administrators can: - Enable or disable API token authentication in Rovo MCP server settings - Manage and revoke MCP app access from the Connected Apps list - Control which external domains can connect via domain allowlists - Monitor activity through Atlassian audit logs - Configure IP allowlisting for additional security

[!IMPORTANT] MCP clients can perform actions in Jira, Confluence, and Compass with your existing permissions. Use least privilege, review high-impact changes before confirming, and monitor audit logs for unusual activity. See MCP Clients - Understanding security risks.


Updated Feb 25, 2026
Version 2.0

1 Comment

  • dushyantMS's avatar
    dushyantMS
    Occasional Reader

    Great update dbandaru​ - it has been great collaborating with you to bring this together for our shared customers.