fabriclink

Permissions & consent

Fabric Link uses read-only Jira permissions and a customer-controlled Entra identity for Fabric writes. Data leaves Jira only toward endpoints you authorize.

Jira permissions

The Forge app requests read access to issues, fields, projects, and (optionally) Jira Service Management entities. It does not modify Jira issues, comments, or workflows.

Typical scopes include:

  • Read issues and issue history (changelog)
  • Read projects and project configuration
  • Read JSM request types and SLA data (when JSM mirroring is enabled)
TODO: Confirm final Marketplace scope list with legal before publish.

Entra service principal

You create and own the service principal. Fabric Link stores the client secret in Forge encrypted storage for the duration of the connection. Rotate secrets in Entra and update the wizard when they expire.

Recommended practice:

  • Dedicated app registration per environment (prod / staging)
  • Contributor on the target Fabric workspace only
  • Secret rotation on a fixed schedule

Egress allowlist

The Forge app can reach only Microsoft endpoints required for Fabric mirroring — Entra token exchange, Fabric API, and OneLake. No third-party analytics or storage services sit in the path.

| Destination | Purpose | | --- | --- | | login.microsoftonline.com | Entra authentication | | Fabric REST API | Workspace and mirroring operations | | OneLake | Change file delivery |

TODO: Security team to confirm final egress list for Marketplace submission.

Data residency

Mirrored data lands in your Fabric workspace, in the region your tenant administrator selected. Atlassian hosts the Forge runtime; issue payloads are not persisted outside the sync pipeline longer than required for delivery.

Next steps