Forum Discussion

tanjarienesl's avatar
tanjarienesl
Copper Contributor
Jan 29, 2024

Microsoft Confluence Connector shows sensitive data

Hey community, 

We have set up the Confluence Cloud Connector for MS Search and are faced with the problem that the search results show content that the respective user is not authorized for in Confluence. Users log in to Confluence with their Entra ID data - we have SSO enabled. The E-Mail-ID of the users in Confluence matches with the UPN in Entra ID. The permissions in Confluence have been defined at the space and page level. We configured "Only people with access to this data source" can see results. 

Do you have further ideas, what could cause our problem?

Best regards, 

Tanja

microsoft 365
Microsoft Search

2 Replies

Sort By
  • smylbugti222gmailcom's avatar
    smylbugti222gmailcom
    Iron Contributor
    Feb 22, 2024

    It's concerning that the Microsoft Confluence Connector is showing sensitive data to unauthorized users. Here are some potential causes and troubleshooting steps you can explore:

    1. Incorrect Search Permissions:

    Double-check the search permissions configured for the Confluence connector in Microsoft Search. Ensure it's set to "Only people with access to this data source" as you mentioned.
    Verify if any groups or users have been accidentally granted broader search permissions than intended.
    2. Caching Issues:

    Sometimes, cached data can lead to outdated or inaccurate search results. Try clearing the search cache in Microsoft Search and see if the issue persists.
    3. Synchronization Issues:

    Ensure proper synchronization between your Confluence and Entra ID instances. Inconsistencies in user permissions or group memberships could lead to unauthorized access in search results.
    4. Confluence Permissions:

    Review the Confluence space and page permissions meticulously. Ensure that users only have access to the content they are authorized to see. Consider using granular permissions at the page level for finer control.
    5. Entra ID Configuration:

    Verify that user and group memberships are correctly reflected in Entra ID and synchronized with Confluence. Any discrepancies can lead to permission issues.
    Additional Tips:

    Audit Logs: Utilize Confluence's audit logs to track user activity and identify any unauthorized access attempts.
    Microsoft Support: If the issue persists, reach out to Microsoft support for further assistance. They can investigate the issue from their end and provide more specific guidance.
    Here are some resources that might be helpful:

    Confluence On-premises Microsoft Graph connector (Preview): https://learn.microsoft.com/en-us/microsoft-365-app-certification/teams/move-work-forward-confluence-connector-by-mwf
    Protect your Atlassian environment - Microsoft Defender for Cloud Apps: https://learn.microsoft.com/en-us/defender-cloud-apps/protect-atlassian
    Remember, addressing this issue promptly is crucial to ensure data security and prevent unauthorized access to sensitive information.

Resources