Skip to main content
This page is for IT administrators and security reviewers evaluating Circuit’s integrations with third-party systems like Microsoft 365, Google Workspace, Salesforce, and Atlassian. Use it to understand what Circuit accesses, how it handles credentials, and how to grant or revoke tenant-wide approval. For end-user setup steps, see the per-integration pages under Integrations.

​
How Circuit handles integration credentials

When a user connects an integration, Circuit stores the resulting credential (access token, refresh token, API key, or shared key) so it can read data on the user’s behalf. For the broader security architecture, see Security overview.

​
Integrations that require admin involvement

Most integrations work out of the box for individual users. The ones below typically need admin attention before users can connect, either because the provider’s defaults restrict third-party apps or because the integration is workspace-scoped rather than user-scoped. Slack, Notion, GitHub, Azure Blob Storage, HubSpot, and RSS feeds typically do not require Entra or Workspace approval, since they authenticate with a token the user generates directly in the provider. Circuit’s Microsoft integrations (Outlook, Dynamics 365, OneDrive, SharePoint) authenticate through a single Circuit-published enterprise application in your Entra tenant. When a tenant requires admin approval for third-party apps, the first user to connect sees the consent screen blocked, and the integration cannot complete until an admin grants tenant-wide consent.

​
Required role

The admin granting consent needs one of these Entra roles:
  • Cloud Application Administrator for most permissions
  • Application Administrator for most permissions
  • Privileged Role Administrator if Microsoft Graph application permissions are involved

​
Steps in the Entra admin center

1

Sign in to the Microsoft Entra admin center

Open entra.microsoft.com and sign in as a Cloud Application Administrator (or higher).
2

Open the Circuit enterprise application

Go to Entra ID > Enterprise apps > All applications. Search for Circuit and select it. If Circuit does not appear, ask one user to begin the connection flow first; their attempt provisions the app in your tenant even though their consent is blocked.
3

Review the requested permissions

Select Permissions under Security. The page lists every Microsoft Graph scope Circuit will request. Compare it against the per-integration page in this documentation.
4

Grant tenant-wide admin consent

If you agree with the scopes, click Grant admin consent for your tenant. You’ll be redirected to a Microsoft consent screen to confirm. After confirming, all users in your tenant can complete the Circuit connection without seeing the consent screen.
If you know Circuit’s client ID for the integration you want to approve, you can navigate directly to:
Circuit’s published client IDs by integration are listed on each integration’s setup page.

​
Limiting which users can use the integration

After granting consent, Entra still lets you restrict the application to specific users or groups. On the Circuit enterprise application:
  1. Open Properties and set Assignment required? to Yes.
  2. Open Users and groups and assign the users or groups allowed to connect.
This is independent of Circuit’s own user and group permissions.

​
Approving Circuit in Google Workspace

Google Workspace administrators can control which third-party OAuth applications access Workspace data (Gmail, Drive, Calendar, Contacts). Restrictive policies will block Circuit’s connection screen until an admin marks the app as Trusted or Limited.

​
Required role

The admin needs the Service Settings administrator privilege (typically held by Super Admins).

​
Steps in the Google Admin Console

1

Open API controls

In the Google Admin Console, go to Menu > Security > Access and data control > API controls.
2

Open Manage App Access

Click Manage App Access to see the list of configured and accessed third-party apps.
3

Configure Circuit as a new app

Click Configure new app, then OAuth App Name Or Client ID. Enter Circuit’s OAuth client ID (listed on the Google Workspace and Google Drive pages) and click Search.
4

Select the org units and access level

Choose the organizational units where Circuit should be approved. Then choose an access level:
  • Trusted: Circuit can access both restricted and unrestricted Google services.
  • Limited: Circuit can access only unrestricted services.
  • Specific Google data: Circuit can access only the scopes you list. Useful when you want to permit Drive access but block Gmail, for example.
  • Blocked: Circuit cannot access Google data. Use this to prevent the integration entirely.
Click Continue, review, and click Finish.
Access level changes can take up to 24 hours to propagate across Google’s systems.

​
Approving Circuit in Atlassian

Atlassian site admins approve third-party OAuth apps (Confluence, Jira) at the organization level. Until approval is granted, users hitting Circuit’s connection flow see a “Your site admin must authorize this app” error.

​
Required role

Organization admin or Site admin on the Atlassian organization.

​
Steps in Atlassian Administration

1

Open Atlassian Administration

Go to admin.atlassian.com and select your organization.
2

Open Connected apps

Select Apps > Atlassian apps, then choose Connected apps in the sidebar.
3

Find Circuit and authorize it

Locate the Circuit app in the list (it appears after the first user attempts to connect). Review the scopes Circuit requests, then approve the app for your organization.
If your organization has set Block user apps, only org or site admins can install third-party apps. Either lift that restriction temporarily or install Circuit yourself on behalf of your users.

​
Reviewing and revoking access

Each integration can be revoked from two places: inside Circuit and inside the provider. Tenant-wide revocation by an admin (for example, removing the Circuit enterprise application in Entra) invalidates all of that tenant’s tokens immediately. Per-user revocation invalidates only that user’s tokens.

​
Data residency

A few integrations let users (or admins) choose where data is read from:
  • Bluebeam: Studio API is region-scoped. Users pick us, eu, au, uk, or se when connecting. See Bluebeam.
  • Salesforce: Circuit detects the user’s Salesforce instance URL during OAuth. If your org migrates between data centers (for example, during a Hyperforce move), affected users may need to reconnect.
  • Azure Blob Storage: The user supplies the storage account name and access key, so all data stays within the storage account’s existing region.

​
Network requirements

Circuit calls provider APIs from outbound IP ranges that vary by deployment. If your organization restricts egress, the destinations Circuit needs to reach include:
  • *.microsoft.com, *.microsoftonline.com, graph.microsoft.com for Microsoft 365 integrations
  • *.googleapis.com, accounts.google.com for Google Workspace and Drive
  • *.atlassian.com, *.atlassian.net for Confluence and Jira
  • *.salesforce.com, *.my.salesforce.com, *.force.com for Salesforce
  • *.slack.com for Slack
  • *.notion.com, api.notion.com for Notion
  • *.hubapi.com, *.hubspot.com for HubSpot
  • api.github.com for GitHub
  • *.bluebeam.com, studioapi.bluebeam.com for Bluebeam
  • *.blob.core.windows.net for Azure Blob Storage

​
Per-integration scope summary

The table below summarizes what each integration reads or writes. Full scope details are on each integration’s setup page.

​
Where to get help

  • For integration setup questions, see the per-integration pages under Integrations.
  • For broader security questions, see Security overview and SSO setup.
  • For approval bottlenecks at the provider level, the provider’s own admin docs are usually the fastest path. Links are included on each integration page.