ATLASSIAN CLOUD ENTERPRISE · GUARD PREMIUM · REGULATED INDUSTRIES
Your auditors move to the cloud with you.
In Data Center you built your own data segregation: a dropdown on every page, classified, reported back to the auditors. Cloud has to answer the same questions on day one – with Guard Premium instead of custom code.
THE AUDIT GAP
Compliance is what stalls migrations – so we start there.
Dozens of instances across group companies, each with its own admins and its own rules. The technical migration is solvable; convincing the auditors is the hard part.
Custom segregation does not travel
The Data Center dropdown that classified every page – and the reporting behind it – has to be rebuilt on platform capability, not plugin code.
Nobody knows where the data is
Sensitive content is never neatly inside the project intended for it. It is everywhere – and the auditor asks exactly that question.
Many admins, one standard
A dozen Jira admins each doing things slightly differently. Someone opens anonymous access to share a ticket – and the question becomes who is really in control.
CLASSIFICATION & POLICY
Labels alone do nothing. Married to policies, they do everything.
A classification is a name and a colour. The value appears when data security policies act on it – centrally, and beyond the reach of local admins.
A floor, not a wish
Set the organisation default so everything is at least internal from day one – then classify upward at whatever pace the business can carry.
Policies that enforce
No attachment downloads above a given classification. No anonymous access. No public links. Applied per space and project, decided once.
Marketplace apps in scope
A dedicated policy restricts where third-party apps may reach. Every vendor is a supply-chain question; this is the answer you can show an auditor.
Start at zero risk
Turn Premium on with no policies enabled, watch the logs and alerts, understand the environment – then act. Nobody loses access while you learn.
GOVERNANCE ACROSS GROUP COMPANIES
One organisation admin. Policies a Jira admin cannot override.
SITE ADMIN
Data security policies
Classification catalogue
Project & space workflows
Space-level exception
ORG ADMIN
Data security policies
Classification catalogue
Project & space workflows
Space-level exception
THE MICROSOFT PURVIEW GAP
If your labels live in Purview, someone has to keep both sides honest.
There is no turnkey connector today.
Recreate the five levels
The same sensitivity levels you use in Purview, entered once in the Atlassian organisation. Fast to do, and manual forever without an integration.
Read labels, push logs back
A Marketplace app that reads sensitivity labels from Purview and returns the audit trail – so auditors stay in the tool they already trust instead of learning Jira.
You are not stranded
If Atlassian ships the connector later, you lose nothing – the classifications, policies and log routing are already in place and the integration retires quietly.
AVAILABLE, PLANNED, IN THE WORKS
Build for today. Plan for the next release.
We track the roadmap so your architecture never has to be rebuilt.
Classifications, policies, detections, verbose logs
Everything needed to answer the audit questions you answer today in Data Center.
Policies on classifications · Rovo chat security · attachment scanning
In early access and weeks out – including detections for what users send to and request from the AI.
Classification-based access control
Access driven by classification rather than permissions alone – no committed date. Until then we solve it with permission-group workarounds that survive the switch.
Policies written in plain language
Hand over the policy document instead of writing regular expressions, and let the rules be drafted from it.
DETECTION & AUTOMATION
Find the data, classify it automatically, then act on it.
Around 70 detections ship out of the box: social security numbers, IBANs, credit cards, health and financial entities, AWS keys – some regional, all ready. Anything else becomes a custom detection with a regular expression. Find a card number anywhere and it is classified confidential automatically – unless it already sits higher. This is what calms auditors: you know where the sensitive data is, even outside its intended home.
- ~70 detections out of the box, plus custom regex patterns
- Automatic classification the moment a match shows up anywhere
- Automation on the alert: restrict, notify, branch
- User activity in view: suspicious searches, mass exports, logins from Tor exit nodes
Every content-scanning alert can trigger an automation: restrict the page, email the owner, branch on the pattern. Two separate streams carry the evidence – the immutable organisation audit log (webhook or REST API) to the platform team, the Guard Detect alert webhook to security.
HOW WE RUN IT
Observe, tune, then automate – never the other way round.
Observe first, then act.
Turn it on, change nothing
Premium enabled, no policies active. Watch the logs and alerts and learn what your environment actually looks like.
Tune the patterns
A sloppy detection matches everything. We let custom detections run for hours before anything automatic hangs off them.
Automate the obvious
Restrict and notify where the pattern is unambiguous; keep a human in the loop where it is not. Nobody has time to read every alert.
Hand the auditors the evidence
Log routing into your SIEM, policies on the record, exceptions documented – the migration case makes itself.
FREQUENTLY ASKED
What auditors and IT leadership ask first.
Answers that speed up the migration decision.
Not as code, but as an outcome: instead of a self-built dropdown with custom reporting logic, you get five to ten levels, an organisation default, and policies that act on every level. The migration translates the rules; it does not rewrite the app.
The organisation default sets a floor – everything starts at least internal from the moment you enable Premium. You classify existing content at whatever pace your team can carry; automatic classification via detection runs in parallel, independent of manual progress.
That depends on the environment, not the technology: we enable Premium with no policies, watch logs and alerts for a few weeks, tune custom detections, and only then switch on automatic restrictions. That prevents an overly broad rule from blocking real work.
Guard Premium fully covers the Atlassian side. Without an integration, Purview labels and Atlassian classification stay two separate systems that must be kept in sync by hand – exactly the gap we close with a Marketplace app once it is needed.
NEXT STEP
Bring your auditors' questions. We will answer them one by one.
A compliance review of your Data Center setup against Guard Premium – what maps directly, what needs a workaround, and what is worth waiting for. You leave with the roadmap, not a pitch.