Hi everyone,
I’m trying to connect to our organization’s JIRA system using the REST API, but I’m having trouble with the authentication flow. When I log in manually through the web browser, here’s what happens:
- I go to our company’s Atlassian site
- Gets redirected to the login screen
- I enter my work email
- Takes me to Microsoft’s auth page where I click “Continue”
- I put in my Active Directory password
- I have to pick a verification method (usually get a code on my phone)
- Finally logged in
I have two main questions:
Question 1: Is there a way to automate this entire login sequence using C# code?
Question 2: Will my app need to handle the phone verification step every single time it runs?
For context, I’m planning to deploy this as an Azure Function that runs on a schedule to pull data from JIRA automatically. Right now I’m completely stuck on getting past the authentication part.
Any help would be really appreciated!
I’ve hit this same issue with Atlassian Cloud APIs. Don’t try to replicate the browser login flow - it’s meant to be interactive and MFA will mess you up every time. For Azure Functions, use API tokens instead. Go to your Atlassian account settings, hit the Security section, and generate an API token. Use basic auth with your email as username and the token as password. This skips the whole SSO mess including phone verification. But here’s the gotcha - if your org enforces SSO-only access, API tokens might be disabled. You’ll need your admin to either enable tokens for your account or set up OAuth 2.0 properly. OAuth’s more complex but handles SSO integration without needing interactive auth for every call. For scheduled stuff like yours, definitely don’t automate browser login. It’s unreliable and breaks whenever Atlassian updates their auth pages.
oauth2’s your best bet, but check if your atlassian setup supports app passwords first. look under account settings > security for the “app passwords” option. way simpler than the full oauth flow and perfect for automated stuff like azure functions. no mfa headaches once it’s configured.
The authentication flow you’re dealing with can indeed be complex, but there are ways to handle it programmatically. Given that you’re utilizing Microsoft SSO, I recommend avoiding attempts to automate the browser login entirely. Instead, leverage Microsoft’s authentication libraries that are designed for such scenarios. For your Azure Function, establishing a service account for API access may be beneficial if your organization permits it, as these accounts typically bypass Multi-Factor Authentication (MFA) requirements. Coordinate with your IT department to facilitate this setup. If service accounts are off the table, explore the options for Personal Access Tokens or API tokens available in JIRA, which can simplify authentication for automated processes. Ensure to review your JIRA admin settings to identify any available token options. Regarding the phone verification step, this generally would need to be managed each time, unless you can configure trusted locations or utilize certificate-based authentication. This is why service accounts often provide a more streamlined solution for scheduled tasks.