[v-krishnachi (v-krishnachi)]

Updates the Atlassian Organization Audit Events CCF connector to reduce historical backlog polling and mitigate Atlassian API rate limiting.

The connector previously used an unbounded persistent cursor with ascending sorting. For high-volume Atlassian organizations, a new connection could therefore paginate through a large historical backlog before reaching current events. Paginated requests were also not explicitly throttled, which could result in HTTP 429 responses.

Changes
Added a from query parameter using CCF’s {_QueryWindowStartTime} value so new connections start from a recent time boundary.
Added queryTimeFormat: UnixTimestampInMills to format the from value as Unix epoch milliseconds, as required by Atlassian.
Increased the Atlassian request limit and CCF pageSize from 200 to 500, the documented maximum supported by /events-stream.
Added pageSizeParameterName: limit to keep the CCF page size and API request parameter aligned.
Added paginatedCallsPerSecond: 0.8, limiting pagination to approximately 48 requests per minute and keeping it below Atlassian’s documented limit of 50 requests per minute per API path.
Added pagingQueryParamOnly: true so subsequent cursor requests use the paging parameters without repeatedly applying the initial time boundary.
Preserved PersistentToken pagination so polling continues from the last saved Atlassian cursor across polling cycles.
Bumped the solution and connector package version from 3.0.3 to 3.0.4.
Regenerated Package/mainTemplate.json and added the 3.0.3 solution package.
Updated the solution release notes.
Expected behavior
For a new or reset connection:

The initial request starts from a recent CCF query-window boundary instead of the beginning of Atlassian’s retained history.
The connector requests up to 500 events per page.
Subsequent pages continue through Atlassian’s cursor.
Paginated requests are limited to approximately 48 requests per minute.
The persistent cursor is retained across polling cycles for continuous collection.
This reduces historical backlog processing and the likelihood of HTTP 429 responses. It also reduces the number of API calls required to retrieve the same event volume by up to 60% compared with the previous 200-event page size.

Customer impact
No table schema or DCR field mapping changes.
No KQL parser changes.
Existing data in AtlassianAuditEvents_CL is unaffected.
Existing connections with an already persisted historical cursor might need to be deleted and recreated after the updated package is deployed for the new initial from boundary to take effect.
Some duplicate delivery can still occur under at-least-once ingestion semantics after a transient failure; this change reduces the rate-limit and backlog conditions that contributed to repeated page processing but does not introduce stateful ingestion deduplication.
Documentation validation
Microsoft CCF documents UnixTimestampInMills as a supported QueryTimeFormat constant. The spelling is intentional.
Atlassian documents the /events-stream from parameter as Unix epoch time in milliseconds.
Atlassian documents the /events-stream limit range as 1–500, with 500 as the maximum.
Atlassian documents a polling API limit of 50 requests per minute per API path.
References:

Microsoft CCF request configuration: https://learn.microsoft.com/en-us/azure/sentinel/data-connector-connection-rules-reference#request-configuration
Atlassian /events-stream API: https://developer.atlassian.com/cloud/admin/organization/rest/api-group-events/#api-v1-orgs-orgid-events-stream-get
Atlassian API rate limits: https://developer.atlassian.com/cloud/admin/organization/rest/intro/#rate-limits
Validation performed
Regenerated the 3.0.3 solution package using the repository V3 packaging tool.
Confirmed the source poller configuration and generated ARM template contain matching request and pagination settings.
Confirmed the generated ZIP contains the updated template.
JSON syntax validation passed.
KQL validation passed for 5 files.
ARM-TTK passed all 48 checks.
Microsoft branding, document-link, solution, workbook, playbook, field-type, classic Application Insights, and hyperlink validations passed.
git diff --check passed.
Validation summary: 11 passed, 0 failed, 6 skipped. The skipped checks were not applicable or unavailable in the local environment (.NET Core 3.1 and TruffleHog were not installed).

Files changed
Solutions/AtlassianOrganizationAudit/Data Connectors/AtlassianOrganizationAuditConnector_CCF/AtlassianOrganizationAudit_PollerConfig.json
Solutions/AtlassianOrganizationAudit/Data/Solution_AtlassianOrganizationAudit.json
Solutions/AtlassianOrganizationAudit/Package/mainTemplate.json
Solutions/AtlassianOrganizationAudit/Package/3.0.3.zip
Solutions/AtlassianOrganizationAudit/ReleaseNotes.md

Customer also verified and confirmed that no duplicate logs and historical logs.

[v-maheshbh (v-maheshbh)]

Hi v-krishnachi (@v-krishnachi)
Kindly attach a screenshot showing the CCF connector in a connected state for validation and review purposes.

Thanks!

[v-krishnachi (v-krishnachi)]

v-maheshbh (@v-maheshbh) , waiting for the customer confirmation on this fix. will attach the screenshot once customer issue is resolved.
keep it active until

[v-krishnachi (v-krishnachi)]

Hi v-krishnachi (v-krishnachi (@v-krishnachi)) Kindly attach a screenshot showing the CCF connector in a connected state for validation and review purposes.

Thanks!

customer also confirmed it worked.