Current Problem:

When an organization administrator enables a third-party connector (e.g., Google Drive, GitHub, Slack, SharePoint) for Atlassian Rovo, individual users must often perform a secondary step to connect their own Atlassian account to that specific third-party service to see personalized results.

Currently, the Atlassian Organization Audit Logs only record high-level admin actions (such as "Created 3P Connector connection"). There is no visibility for administrators to track when an individual user successfully authorizes or revokes their personal connection to these apps. This lack of granular logging prevents admins from:

1. Monitoring the security posture of which users have granted Rovo access to external data.
2. Tracking user adoption of specific Rovo connectors.
3. Troubleshooting issues where a user claims they cannot see results from a connected app.

Suggested Solution:

Expand the "Rovo user actions" or "Security policies" audit log categories to include events for individual user-level authorizations across all third-party connectors. Suggested events include:

• User authorized connector: Logged when a user successfully completes the OAuth/connection flow for a specific app (e.g., "User [Name] authorized Google Drive connector").
• User de-authorized connector: Logged when a user disconnects their account from a specific app.
• Authorization failed: Logged when a user attempts to connect but the process fails, including the error reason.

Each log entry should include the User ID, Timestamp, Connector Name, and Source IP.