Quick Connect OAuth 2.0
Quick Connect OAuth 2.0 is an authentication option for Kibana connectors that removes the need to create and manage your own OAuth app. Elastic hosts and maintains the OAuth app for each supported service. Select Quick Connect OAuth 2.0 when you create the connector, then sign in to the service and authorize access.
With other OAuth-based authentication types, you register an app with the service provider, configure scopes and redirect URIs, and copy a client ID and client secret into Kibana. Quick Connect OAuth 2.0 skips those steps.
The following connectors support Quick Connect OAuth 2.0:
| Connector | Access granted |
|---|---|
| Gmail | Read-only. Write actions require OAuth 2.0 authorization code authentication. |
| Google Calendar | Read-only access to calendars and events. |
| Google Drive | Read-only access to files and file metadata. |
| Slack (v2) | Search and read messages, channels, users, and files, and send messages. |
| Microsoft Teams | Read teams, channels, chats, and messages, and send messages. |
| SharePoint Online | Read-only access to sites and files. |
- In Kibana, go to Stack Management → Connectors and create a connector for one of the supported services.
- For the authentication type, select Quick Connect OAuth 2.0.
- Follow the prompt to sign in to the service and authorize the Elastic app to access your organization's data.
You don't enter a client ID, client secret, redirect URI, or scopes. Kibana stores the resulting tokens and refreshes them automatically.
Your organization might restrict which third-party apps can access company data. If you see a message indicating that you need approval, ask your administrator to approve the Elastic app, then authorize the connector again.
Depending on the service, administrators typically need to:
- Google Workspace (Gmail, Google Calendar, Google Drive)
- Allow the Elastic app in the Google Workspace admin console if your organization restricts third-party app access.
- Microsoft 365 (Microsoft Teams, SharePoint Online)
- Grant tenant-wide admin consent for the Elastic app in Microsoft Entra ID if user consent is turned off. For SharePoint Online, an administrator might also need to grant the app access to specific sites.
- Slack
- Approve the app for the workspace if your workspace requires app approval.
- Per-user access: The connector acts as the user who authorized it, so it can only access data that user can access.
- Fixed scopes: The permissions are predefined for each connector and can't be changed. If you need different scopes, or access that Quick Connect OAuth 2.0 doesn't grant, use the OAuth 2.0 authorization code authentication type with your own app.
- Token refresh: Kibana refreshes access tokens automatically. If you revoke the authorization or it expires, re-authorize the connector from the connectors list.
Quick Connect OAuth 2.0 is the recommended option for connectors that support it. Use another authentication type if you need to:
- Run write actions that Quick Connect OAuth 2.0 doesn't allow, such as Gmail write actions.
- Control the OAuth app, its name, or its scopes.
- Run the connector with one shared account instead of each person's own account, for example, with OAuth client credentials (app-only access).
To compare the authentication types for a connector, refer to its page in Supported connectors.