Atlassian changes worth knowing

19 September 2026

The community forum is frozen until it moves on 22 September

community.atlassian.com is running in read-only mode while it moves to a new platform, currently planned to go live on 22 September. New comments are closed on existing posts.

What it means. For most admins the community is the place where an odd Confluence behaviour gets explained, and right now you cannot ask. The part worth planning for is afterwards: a platform move usually renumbers threads, and nobody has promised that today's thread addresses survive it. If your runbooks link to a community answer, those links are the ones at risk.

What to do. Spend ten minutes on the handful of community threads you actually rely on and copy the answer itself into your own space, with the link kept as a reference rather than as the source. If you have a question queued up, hold it until the new site is up rather than losing it in the changeover.

Organisation API keys get scopes, and a hard one-year life

Atlassian is adding scopes to organisation API keys, so a key can be limited to view, write or delete. The same note states the limit plainly: "Keys can last no longer than a year." Keys are created under Settings, then API keys.

What it means. Two changes in one. New keys can stop being all-powerful, which is welcome. The other half is a deadline with your name on it: an integration wired to an organisation key now has an expiry date, and the failure will arrive on a date nobody wrote down, usually as a script that quietly stops doing its nightly job.

What to do. List the organisation API keys you have, write down what each one is used by and when it was made, and put a calendar reminder a month before each anniversary. Do that before you need the new scopes, because the expiry hits keys whether or not you use scopes.

Watching user API tokens no longer needs a paid subscription

Monitoring user API tokens — when they expire, when they were last used, who created them, and revoking them — is becoming available without an Atlassian Guard Standard subscription. It covers managed accounts, under Security, then User API tokens.

What it means. This is the list where leavers' tokens turn up. Until now it sat behind a subscription that plenty of small sites do not buy, so on those sites nobody had ever looked.

What to do. Open it once and read it properly. Any token that has not been used in months, or belongs to someone who left, gets revoked today rather than at the next audit.

Beacon becomes Guard Detect inside the CSVs you parse

For organisations that were in the Beacon beta, the word Beacon is being replaced with Guard Detect in exported CSV files: managed accounts, audit logs, external users, user API tokens and authentication policies. Group names such as beacon-admins are not changing.

What it means. A rename inside a file format is the kind of change that breaks a script silently. If something of yours filters an audit log export on the string "Beacon", it will keep running and start matching nothing, which reads exactly like a quiet month.

What to do. Grep your scripts and saved filters for "Beacon" and make them accept both spellings. The group names are unchanged, so leave those alone.

You can now decide which AI tools are allowed to connect

A new control governs which domains may reach your Atlassian apps through the Rovo MCP server: use Atlassian's list of supported domains, block the lot, or allow named domains. It lives under Apps, then AI settings, then Rovo MCP server.

What it means. External AI tools connect to Confluence content through this door, and until now the question of which ones was not really an admin's to answer. It is now, and the honest version of the question is not "do we trust AI" but "which specific tools do we intend to read our documentation".

What to do. Open the setting and make the decision deliberately, once, rather than discovering the default during a security review. Whichever way you go, write the reason next to the answer, because this is the question your auditor asks next year.

Cloud Fortified is closing before its replacement opens

As of 17 September, submissions for Atlassian Enterprise Certified had still not opened; the Marketplace changelog said only that they would open "around the end of September". Cloud Fortified stopped accepting new submissions on 1 September and the programme retires on 31 December 2026.

What it means. For a few months there is a gap where the old badge is winding down and the new one does not exist yet. An app that looks less certified this autumn may simply be an app caught between two programmes, and an app still showing Cloud Fortified is showing a badge with an expiry date.

What to do. Stop using the badge as the filter this season and read the app itself: platform, where data lives, and who answers support. Runs on Atlassian is unaffected and remains a real signal, because it is verified automatically rather than applied for. Our notes on what the badges mean now and the checklist before installing an app cover the rest.

A postscript on the release notes move

We wrote on 11 September that the weekly cloud release notes stop on 30 September. One practical detail has emerged since: the new home is a script-driven page, so it comes up empty in anything that reads plain HTML, which includes a fair number of the tools people use to watch a page for changes.

What to do. If you were planning to point a change watcher at the new page, subscribe to the weekly email instead, at preferences.atlassian.com with the Cloud Release Notes box ticked. Check it arrives before the old page stops updating on 30 September.

11 September 2026

XML site and space export is on a clock

Atlassian has set 1 December 2026 as the end of life for XML site export and XML space export in Confluence Cloud. The features keep working after that date; what ends is bug fixes, support tickets and any SLA. CSV export is named as the fully supported alternative, and it is on all plans.

What it means. Nothing breaks on 1 December. What disappears is anybody helping you when it does break, and this is the export you run on the day you are leaving a platform or the day an auditor asks for a record. Those are bad days to be on an unsupported path.

What to do. Search your runbooks and compliance procedures for "XML export" and change the wording to CSV before December, then run a CSV export once on a real space so the first one is not the important one. One exception: if you use XML to move content from Cloud to Data Center, CSV cannot be imported into Data Center, and Atlassian asks you to contact support about alternatives rather than offering a replacement. We updated our write-up of space exports with this.

Blocking exports is about to block attachment downloads too

Atlassian is extending the data export rule in data security policies so that it also blocks downloading files attached to Confluence and Jira pages. It is rolling out now, and it needs Atlassian Guard Standard.

What it means. This lands on policies you have already written. If a policy of yours blocks data export today, users in the spaces it covers will stop seeing the download button in attachment lists, macros and file previews. Atlassian says the reasoning is that organisations blocking exports usually wanted downloads blocked as well. Often true, and occasionally very much not.

What to do. Go to admin.atlassian.com, then Security, then Data security policies, open each policy and check whether exporting data is blocked. If it is, warn the affected teams before the button disappears, or you will spend a morning on tickets about a broken attachment list. If you needed exports blocked but downloads allowed, that combination is going away, so decide now which of the two you actually care about.

The element browser changes in October, not in 2027

On 5 September we wrote that app macros will appear in a single category from 25 February 2027. That date is correct, but it is not the first one. Atlassian expects to start rolling out new element browser categories on 6 October 2026, in the slash menu as well as the modal browser.

What it means. Two separate things happen. In October the category names change and the slash menu starts showing categories it does not show today: the ten headings an app macro can sit under today (Formatting, Confluence content, Navigation, Admin, Reporting, Development, External content, Media, Visuals and images, Communication) become five (Structure, Media, Embed, Text formatting, Data and charts). Your users' muscle memory for finding a macro goes with them. Then in February 2027 any app macro left without a valid category drops into an "Other elements" heading, which is a place nobody browses.

What to do. Nothing to configure: the work is on vendors. Put 6 October in the calendar, and if you keep an internal page explaining where to find which macro, plan to rewrite it that week. When someone reports in October that a macro has vanished, look under the new categories and under "All" before you open a ticket with the vendor.

Apps may send data to analytics tools, and the setting is on by default

A new organisation setting lets admins decide whether the apps they run can send data to third-party analytics tools. Atlassian is explicit about the default: the setting is enabled, which allows data sharing for all new app installations.

What it means. When someone installs an app next month, the question of whether that app may ship usage data to an outside service is already answered, in favour of sharing, unless you have touched the setting. This is the same ground the Runs on Atlassian badge covers, since one of its criteria is that customers control data egress such as analytics and logs.

What to do. Open the Connected apps page and make the decision once for the whole organisation, before the next install rather than after it. You can also set it per app. And if your security review asks where an app's data goes, this setting now belongs in the answer alongside the app's platform and hosting. Our checklist for installing an app covers the rest of that conversation.

Weekly cloud release notes stop on 30 September

The banner is now on every weekly release notes page: "This page will no longer be updated after September 30, 2026." Everything moves to What's new across Atlassian, at community.atlassian.com/release-notes, which adds rollout status, search and filtering.

What it means. If your internal change log is fed from the old weekly pages, by a bookmark, a feed or a person who reads them on Monday, it goes quiet in October with nothing to tell you it has. Silence from a source you trust looks exactly like a calm week.

What to do. Move the bookmark now, and open the new place once before you depend on it, so the first time you use it is not the week you urgently need it. One piece of fine print: the developer changelog for Confluence Cloud is a different page and is not moving.

Vendors can now keep your macros working when they move to Forge

Published on 11 September: a Forge manifest can map old Connect macro keys onto a Forge macro through a new migratedFrom property, so macros already sitting on your pages keep resolving after the vendor moves the app across.

What it means. This was the quiet risk in every Connect to Forge migration. The vendor ships a Forge version, you upgrade, and a macro used on four hundred pages renders as an error because its key changed underneath. There is now an official way to avoid that, with limits worth knowing: parameter schemas are not converted, so the new macro has to understand the old settings itself, and one legacy key can be claimed by only one Forge macro.

What to do. When a vendor announces a Forge version of an app you use, ask one question before upgrading: do existing macros on existing pages still render? Then check it yourself on a copy of a real page rather than an empty one. The wider timetable is in our piece on the end of Connect.

5 September 2026

Connect is being switched off, and admins are now being told directly

Since July, Atlassian has been rolling out migration messages inside the admin interface for sites still running Connect apps. If you have seen a notice about an app needing to move, that is what it is, and it is not a mistake.

What it means. Connect apps cannot be updated after March 2026 and stop receiving fixes by the end of the year. Nothing disappears overnight, but an app in that state is on a countdown, and the vendor either has a Forge version or does not.

What to do. Open your list of installed apps and check each one's platform on its Marketplace listing. For anything still on Connect, look for a migration announcement from the vendor. If there is none and the last update was over a year ago, start looking for a replacement now rather than in December. We wrote a longer piece on what this means for admins.

Cloud Fortified is being retired, Enterprise Certified takes its place

Atlassian stopped accepting new Cloud Fortified submissions on 1 September 2026 and retires the programme on 31 December 2026. Submissions for the replacement, Atlassian Enterprise Certified, open around the end of September.

What it means. If your app approval process has "must be Cloud Fortified" written into it, that rule is about to point at a badge that no longer exists.

What to do. Update the wording in your internal policy before the badge disappears, and separate two different questions while you are at it: where the app's data lives, and what the vendor promises about support. The Runs on Atlassian badge answers the first and is not affected by any of this. Our checklist for installing an app covers both.

App macros will appear in only one category, from February 2027

Announced on 25 August. Today a macro from an app can show up under several categories in the element browser; from 25 February 2027 it will appear in exactly one.

What it means. Mostly a vendor problem, but it lands on your users: a macro your team finds today under two headings will be under one. Nothing breaks, people just look in the wrong place for a week.

What to do. Nothing urgent. If you keep an internal page explaining where to find macros, note it for the January review.

Bulk migration of space permissions to roles

Five new endpoints published in June let you move space permissions from the legacy model to role-based access control in bulk, rather than space by space.

What it means. For a site with dozens of spaces, this is the difference between an afternoon and a fortnight of clicking.

What to do. Only relevant if you are moving to roles. If you are, hand this to whoever writes your scripts before they start doing it by hand.