Referring to https://support.atlassian.com/provisioning-users/docs/connect-to-azure-active-directory/#Connect-to-Azure-Active-Directory
If MSAL throws an error/exception when trying to refresh the security token, the client app (Atlassian) prompts the admin to re-enter their credentials, to resume the connection.
It would be useful to provide a mechanism of notifying the Atlassian Org Admin, via email or in-product banner on admin UI, that user interaction is required to restore the connection to the Microsoft Identity Platform, for access to GRAPH Api calls for provisioning users/groups from Azure Entra ID to Atlassian Cloud.
At this moment, we have no audit log for such events and no notifications, and Org Admins are unaware they need to refresh their Azure credentials, unless they specifically navigate to the Identity Provider Directory page where AD Connect was set up.
Suggestion
