Quick Connect OAuth 2.0
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Preview
Preview
Stack
Planned
Planned
Quick Connect OAuth 2.0 is an authentication option for Kibana connectors that removes the need to create and manage your own OAuth app. Elastic hosts and maintains the OAuth app for each supported service. Select Quick Connect OAuth 2.0 when you create the connector, then sign in to the service and authorize access.
With other OAuth-based authentication types, you register an app with the service provider, configure scopes and redirect URIs, and copy a client ID and client secret into Kibana. Quick Connect OAuth 2.0 skips those steps.
The following connectors support Quick Connect OAuth 2.0:
| Connector | Access granted |
|---|---|
| Gmail | Read-only. Write actions require OAuth 2.0 authorization code authentication. |
| Google Calendar | Read-only access to calendars and events. |
| Google Drive | Read-only access to files and file metadata. |
| Slack (v2) | Search and read messages, channels, users, and files, and send messages. |
| Microsoft Teams | Read teams, channels, chats, and messages, and send messages. |
| SharePoint Online | Read-only access to sites and files. |
- In Kibana, go to Stack Management → Connectors and create a connector for one of the supported services.
- For the authentication type, select Quick Connect OAuth 2.0.
- Follow the prompt to sign in to the service and authorize the Elastic app to access your organization's data.
You don't enter a client ID, client secret, redirect URI, or scopes. Kibana stores the resulting tokens and refreshes them automatically.
Your organization might restrict which third-party apps can access company data. If you see a message indicating that you need approval, ask your administrator to approve the Elastic app, then authorize the connector again.
Depending on the service, administrators typically need to:
- Google Workspace (Gmail, Google Calendar, Google Drive)
- Allow the Elastic app in the Google Workspace admin console if your organization restricts third-party app access.
- Microsoft 365 (Microsoft Teams, SharePoint Online)
- Grant tenant-wide admin consent for the Elastic app in Microsoft Entra ID if user consent is turned off. For SharePoint Online, an administrator might also need to grant the app access to specific sites.
- Slack
- Approve the app for the workspace if your workspace requires app approval.
- Per-user access: The connector acts as the user who authorized it, so it can only access data that user can access.
- Fixed scopes: The permissions are predefined for each connector and can't be changed. If you need different scopes, or access that Quick Connect OAuth 2.0 doesn't grant, use the OAuth 2.0 authorization code authentication type with your own app.
- Token refresh: Kibana refreshes access tokens automatically. If you revoke the authorization or it expires, re-authorize the connector from the connectors list.
Quick Connect OAuth 2.0 is the recommended option for connectors that support it. Use another authentication type if you need to:
- Run write actions that Quick Connect OAuth 2.0 doesn't allow, such as Gmail write actions.
- Control the OAuth app, its name, or its scopes.
- Run the connector with one shared account instead of each person's own account, for example, with OAuth client credentials (app-only access).
To compare the authentication types for a connector, refer to its page in Supported connectors.