Overview

Migration Dashboard - Getting Started

Ready To Migrate Your Confluence Site?

Before moving to the Cloud, you need to know what in your current Confluence environment can make the switch harder. The Migration Dashboard gives you a consolidated view of users, groups, sensitive data, and attachments so you can identify potential migration risks and prioritize cleanup.

Global Scan (button): Run a fresh scan across your entire Confluence site to identify changes in users, groups, sensitive data, and attachments, and update all the numbers on this dashboard.

Get a quick view of potential migration risks

The dashboard surfaces key indicators that can help you understand where your Confluence site may need attention before migration.

Privileged Users: The number of users who have admin-level permissions.

Dormant Users: The number of users who haven't logged in for 90 or more days. These are likely inactive accounts that may not need to be moved to Cloud.

Empty Groups: The number of user groups that currently have no members in them. These are usually safe to clean up since no one is using them.

Total Violations: The total number of security issues found, such as sensitive information (like personal or financial data) detected in your pages.

Total Attachments: The total number of files (attachments) that have been scanned across all pages.

See what is affecting your migration readiness

Migration Readiness Score panel

• Score circle (e.g., "38 – Not Ready"): A single score out of 100 that tells you how ready your site is to migrate. A low score with a "Not Ready" label means there are issues that should be addressed first.
• Risk label (e.g., "High Risk Migration"): A quick-read tag summarizing the overall risk level of migrating right now, based on the score.
• Risk factor breakdown (list): Shows the individual issues contributing to your risk score - Deactivated Users, Dormant Users, Duplicate Users, Empty Groups, Dormant Groups, and Data Violations. Each one shows how severe that specific issue is, along with how much weight (importance) that category carries toward your overall score.
• Total Risk Score: The combined score (e.g., 61.67 / 100) calculated from all the risk factors above.

Get a consolidated view of the issues that may affect your migration and use it to decide what needs attention first.

Find issues in user, group, and data at a glance

Users & Groups overview panel

• Duplicate User: Number of user accounts that share the same email address, a sign of accidental duplicate accounts.
• Deactivated Users: Number of user accounts that have been disabled in Confluence.
• Privileged Groups: Number of groups that have admin-level permissions assigned to them.
• Dormant Groups: Number of groups that don't have access to any spaces, meaning they aren't actively being used.

Data Exposure Summary panel

Understand where sensitive data and large attachments may require attention.

• Pages Affected: Number of pages where sensitive data (violations) were found.
• Critical Pages: Number of pages with high-priority violations that need urgent attention.
• Pages with Attachments: Number of pages that contain at least one file attachment.
• Critical Attachment Pages: Number of pages that contain unusually large attachments needing attention.

Identify the areas of your Confluence site that need cleanup or review before you proceed with migration.

Find Inactive and Duplicate Users With User Analysis

Do you have inactive or duplicate users in your Confluence instance?

Confluence sites can accumulate dormant accounts, deactivated users, duplicate accounts, and users with elevated permissions over time. They can add more bulk to your migration. To remove them, you need to find them first.

Use User Analysis to get a full list of every user account in your Confluence site, along with tools to spot problem accounts (like ones that are inactive, duplicated, or have admin access) and take action on them directly.

See which users need attention

The User Analysis overview provides a summary of your Confluence user accounts:

• Total Users: The total number of user accounts that exist in Confluence.
• Privileged Users: The number of users who have admin-level permissions (extra access to manage the system).
• Dormant Users: The number of users who haven't logged in for 90 or more days. These accounts are likely inactive. (You can update the days threshold in settings.)
• Deactivated Users: The number of accounts that have already been disabled in Confluence.
• Duplicate Users: The number of accounts that share the same email address, which usually means the same person accidentally has more than one account. Atlassian Cloud maintains users’ uniqueness via email ID, so it is important to identify those and remove the excess accounts.

Before migrating to Cloud, review dormant, deactivated, and duplicate accounts and verify whether you need them before migration. A major reason behind migration failures is a large number of inactive users and duplicate or invalid user identities.

Find accounts that need review

User Directory

This is the detailed list of individual user accounts, with tools to search, filter, and manage them.

• Filter dropdown (default: "Need Attention"): Lets you change which group of users is displayed. By default, it shows accounts that may need review (like inactive or unlicensed ones), but you can likely switch it to view other groups.
• Scan: Runs a fresh check of all user accounts and updates the list and summary numbers based on the days threshold.
• Export: Downloads the current user list as a file, useful for record-keeping or sharing with your team.
• Deactivate: Disables the selected user account(s) in Confluence so they can no longer log in; this will help you to reduce the license cost.
• Delete: Permanently removes the selected user account(s).

When your Confluence directory contains years of inactive or unnecessary accounts, filter the directory to identify candidates for review, then deactivate or delete the accounts that no longer need to remain active.

Review each account before taking action

User Directory

The User Directory shows the information you need to evaluate an account before changing it.

• Name: The display name of the user, shown as a clickable link.
• Username: The account's login name and associated email address.
• Status: Shows the current state of the account:
• NEVER USED (blue): The account was created, but the person has never logged in.
• DEACTIVATED (yellow): The account has been disabled and can't log in.
• ACTIVE (green): The account is currently active and in use.
• Last Active: Shows when the user last logged in, or "Never logged in" if they haven't.
• Permission: Shows the user's access level, such as STANDARD_USER (normal access) or SYSTEM_ADMIN (full administrative access).
• License: Shows whether the account is currently using up a paid Confluence license:
• UNLICENSED (red): The account doesn't hold an active license.
• LICENSED (green): The account holds an active license.

Identify duplicate identities before Cloud migration

Are multiple Confluence accounts associated with the same email address?

Duplicate identities are particularly important during Cloud migration because Atlassian Cloud uses email addresses to match user identities. Atlassian's migration guidance specifically addresses duplicate users and provides mechanisms for merging them or otherwise resolving identity conflicts.

Use the Duplicate Users view to identify accounts that share an email address and review their status, activity, permissions, and license information before deciding how they should be handled.

Review privileged users

Who has administrative access to your Confluence instance?

The Privileged Users count helps you identify accounts with admin-level permissions. This is useful when reviewing elevated access before migration or during periodic access reviews.

Atlassian also provides centralized tools for admins to review user and group access and administrative permissions, reinforcing the need to understand who has elevated access.

Make Confluence Permissions Easier to Manage with Group Analysis

Over time, Confluence can accumulate groups that are empty, no longer have access to any spaces, or grant elevated permissions. Confluence permissions are additive. When a user belongs to multiple groups, they can receive the combined permissions granted by those groups. This makes reviewing access even harder.

Use Group Analysis to review your Confluence groups to understand the permissions and space access associated with each group.

Identify groups that may need attention

The Group Analysis overview provides a summary of the groups in your Confluence site:

• Privileged Groups: The number of groups that have admin-level permissions, meaning any member of that group automatically gets admin access.
• Dormant Groups: The number of groups that don't have access to any spaces. Since they can't reach any content, they aren't being actively used.
• Empty Groups: The number of groups that have no members at all.
• Total Groups: The total number of groups that exist in Confluence.

Before migrating to Cloud, review empty, dormant, and privileged groups to identify group structures that may no longer be needed.

Review and clean up groups

Group Directory

A detailed list of individual groups, with tools to search, filter, and manage them.

• Filter dropdown (default: "All Groups"): Lets you narrow the list down to a specific category of groups (for example, only empty or only privileged groups) instead of seeing everything.
• Scan: Runs a fresh check of all groups and updates the list and summary numbers.
• Export: Downloads the current group list as a file, useful for record-keeping or sharing with your team.
• Delete: Permanently removes the selected group(s) from Confluence.

When your Confluence environment contains years of legacy groups, filter for empty or dormant groups to identify groups that may require cleanup. Review privileged groups separately to make sure elevated access is still appropriate.

Understand what each group can do

The directory provides the following information for each group:

Table columns

• Members: The number of users currently in that group.
• Status: Shows the group's current state:
• DORMANT (yellow): The group has members but can't access any spaces, so it isn't doing anything useful.
• EMPTY (blue): The group has no members.
• PRIVILEGED (red): The group has admin-level (SYSTEM_ADMIN) permissions.
• Permission Level: Shows what level of access the group grants its members, such as STANDARD_GROUP (normal access), CREATE_SPACE (can create new spaces), or SYSTEM_ADMIN (full administrative control).
• Spaces Accessible: The number of spaces this group currently has access to. A value of 0 means the group can't reach any content.

Use the group directory to identify groups that grant elevated permissions or no longer provide meaningful access, then review their membership before making changes.

Why group review matters before migration

A migration is a good opportunity to review the groups that have accumulated in your Confluence environment. You might have empty groups that may no longer serve a purpose. Dormant groups may represent legacy configurations. Privileged groups deserve particular attention because their members inherit the elevated permissions assigned to the group.

Atlassian's own access-management guidance recognizes the need to review what users and groups can access, including which spaces they can access and whether they have administrative permissions.

So, before you migrate, identify unnecessary or potentially overprivileged groups, understand their current access, and clean up group structures before they add unnecessary complexity to your Confluence environment or migration.

Find Sensitive Information in Your Confluence With Data Security Analysis

Confluence may contain sensitive information like credentials, customer data, or financial data. Finding these across a large Confluence site is a challenge. When migrated as-is, they can create problems with compliance and raise security concerns.

Use Data Security Analysis to scan Confluence pages for configured sensitive-data patterns, review individual findings, prioritize what needs attention, and protect or remove sensitive values.

Find sensitive data across your site

Scan Results

A page-by-page view of detected sensitive data and the tools needed to investigate and remediate it.

• Select Space: Choose a specific space to narrow the results down to just that space.
• Select Page: Once a space is chosen, pick a specific page within it to focus on. This stays disabled until a space is selected.
• Scan Space: Runs a fresh scan on just the selected space, instead of scanning your entire site.
• Search violations: Lets you search for a specific keyword or match within the results list.
• All Violations: Filters the results to focus on specific types of violations.
• Scan: Runs a fresh scan across all spaces and refreshes the results and summary counts.
• Export: Exports the current violation list for reporting, record-keeping, or further review.

Before moving your Confluence content to Cloud, scan your site to identify sensitive information that may need to be reviewed or remediated first. This is particularly useful when your instance contains years of documentation created by different teams and you do not have a practical way to review every page manually.

Know the type of sensitive data in your Confluence

Use pattern-based filtering to narrow the results to the findings relevant to the task at hand.

For example, you can filter for:

• Payment-card patterns during a PCI-related review.
• Region-specific identity patterns during a privacy review.
• Credentials such as AWS keys or access tokens during security investigations.
• Multiple related patterns at the same time, such as an AWS Access Key ID and AWS Secret Key.

This lets you focus on the highest-priority findings instead of reviewing every detection individually.

When a credential or other secret may have been exposed in Confluence, filter the results to the relevant credential patterns and quickly identify the affected pages.

Review findings before changing the content

Manage Violations

Use Manage Violations to open the findings for a specific page and review individual matches before taking action.

From the detailed view, you can:

• Select all / selection count: Select all detected matches or track the number of selected findings.
• Encrypt: Reversibly protect selected sensitive values while preserving the surrounding content.
• Redact: Permanently replace selected values with *****.
• Delete: Permanently remove selected sensitive matches from the page and its version history.

The app also supports bulk actions when the same remediation needs to be applied to multiple selected findings.

Not every finding needs the same treatment. Review individual matches and choose reversible encryption when the content still needs to remain available, or use redaction or deletion when the sensitive value should no longer remain in the content.

Protect sensitive values without changing the surrounding content

• Encrypt (bulk): Runs on whichever rows/pages are checked. Applies reversible, format-preserving encryption to the sensitive values on those pages, scrambling them in place while keeping the surrounding content intact.
• Decrypt (bulk): Reverses encryption on selected data, turning it back into its original, readable form.
• Redact (bulk): Permanently replaces the matched values on the selected pages with *****. Irreversible.
• Delete: Removes the selected violation record(s) from this list.

Important: Deleting a violation from the results list is not the same as deleting the underlying sensitive content. Use the remediation actions in Manage Violations when you need to change the content itself.

Address sensitive information that remains in page history

Sensitive information can remain a concern even after the current version of a page has been cleaned up. Confluence maintains page history, and administrators have specifically raised concerns about credentials or PII remaining in previous revisions. Atlassian's guidance confirms that page history can be viewed and previous revisions can be managed separately.

The app's detailed remediation workflow allows selected sensitive matches to be permanently removed from the page and its version history.

Prioritize the findings that need attention

Scan Result Table

The Scan Result Table helps you understand where sensitive data was found and how serious each finding is.

• Space Key: The short code identifying which space the page belongs to.
• Page Name: The name of the page where the sensitive data was found, shown as a clickable link to open it.
• Pattern Matches: Lists the type(s) of sensitive data detected on that page, such as "Full Name (Simple)," "URL (HTTP/FTP)," "Procedure Code," or "Twilio Auth Token." If the data has already been protected, this column instead shows a message confirming it was successfully encrypted.
• Severity: Shows how serious the finding is, ranging from Low to Medium, High, or Critical, based on how many violations were found on that page.
• Status: Shows the current protection state of the page:
• Exposed (red): Sensitive data was found and is still visible in plain text.
• Encrypted (green): Sensitive data was found but has already been protected.
• Action: A Manage Violations button that opens detailed options for handling the violations found on that specific page.

When a scan returns a large number of findings, start with pages containing Critical or High-severity violations and credential-related matches, then work through lower-priority findings.

Use custom detection rules for organization-specific data

The app supports custom regex rules, allowing administrators to create detection patterns for sensitive information that may be specific to their organization. Rules can be enabled, disabled, tested, edited, or deleted from the Regex Rules section.

Use it to find sensitive information that may otherwise remain undetected in Confluence, investigate it by type and severity, and apply the appropriate remediation before it becomes a security, privacy, compliance, or migration concern.

Manage Confluence Attachments Pre-Migration With Attachment Scanning

Attachments can make up a significant part of a Confluence site's data. It’s quite difficult to track what sensitive information they may hold. They also consume space in the cloud.

Use Attachment Scanning to inventory attachments across your Confluence site, understand how much storage they consume, and identify pages containing unusually large attachment volumes.

Get an overview of the attachments your instance has

The Attachment Scanning overview gives you a quick picture of attachments uploaded across your Confluence pages and shows you what's there, how much storage they're using, and which pages are carrying unusually large files.

• Total Attachments: The total number of files found across all scanned pages.
• Pages with Attachments: The number of pages that have at least one file attached to them.
• Total Storage: The combined size of all attachments found, shown in KB (kilobytes). Larger totals mean more space your migration will need to account for.
• Critical Pages: The number of pages that contain unusually large attachments and may need special attention before migrating.

Before migrating to the Cloud, use the attachment overview to understand the size and distribution of your attachment data. This gives your migration team a clearer picture of the content that needs to be accounted for.

Find attachment-heavy pages and files

Scan Results

This is the detailed, page-by-page list of every attachment found, with tools to filter and review them.

• Select Space: Choose a specific space (for eg. "Demonstration Space (ds)") to focus the results on just that space instead of your whole site.
• Scan Space: Runs a fresh scan on only the selected space, instead of scanning everything.
• Search attachments: Lets you search for a specific file or page by name within the results.
• All Attachments: Filters the list to show only a certain category of attachments instead of everything (for example, only large files).
• Scan: Runs a full fresh scan across all spaces and updates the list and summary numbers.
• Export: Downloads the current attachment list as a file for reporting or record-keeping.

When your Confluence instance contains a large number of attachments, use the scan results to identify the pages and files consuming the most space. This is particularly useful before a migration or storage cleanup.

Review attachment versions before migration

Result Table

See where attachments are stored and how much space they consume.

• Space Key: The short code identifying which space the page belongs to.
• Page Name: The name of the page the attachments belong to, shown as a clickable link to open it.
• Attachments: A visual preview of each file on that page, showing a thumbnail, the file name, its version number (like "v1" or "v2" — Confluence keeps a history every time a file is replaced), the upload date, and the individual file size.
• Count: The total number of attachment files (including older versions) found on that page.
• Total Size: The combined storage size of all attachments on that page.

The attachment version information is especially useful when a page contains multiple versions of large files. Confluence retains attachment history when files are replaced, so the current file may not represent the full attachment footprint of a page.

Use Attachment Scanning to understand your Confluence attachment footprint before migration, identify pages with unusually large attachment volumes, and give your migration team an inventory they can review and act on.

Get End-to-End Visibility and Evidence With Audit Logs

You need a detailed trail of every action for migration and security. Audit Logs maintain a record of actions performed through the app, giving you a traceable history of scans, remediation actions, and administrative changes.

Track every action performed in the app.

Audit Log Table

Each audit entry provides details about the action and its result.

• Action: The type of action that was performed, such as Full Scan Executed, Attachment Scan Executed, Space Scan Executed, Group Scan Executed, User Scan Executed, Page Encrypted, Page Decrypted, or Group Deleted.
• Performed By: The username of the person (or system) who carried out the action. It is shown here as "admin."
• Target Entity: What the action was applied to. This can be broad (like "All Spaces," "All Groups," "All Users," or a specific "Space key") or very specific, showing exact details of a bulk or selective action. For example, how many pages were included, how many succeeded, and how many failed.
• IP address: The network address the action was performed from, which can help confirm where the request originated.
• Status: Shows whether the action was completed successfully, indicated by a SUCCESS badge.

When preparing Confluence for migration, you can use the audit trail to keep a record of scans and cleanup actions performed through the app. This can help demonstrate what was reviewed and what remediation actions were carried out.

Find the activity you need

The audit log includes tools for locating and retaining relevant records.

• Export: Downloads the current audit log list as a file, useful for compliance records or sharing with your team.
• Delete Logs: Permanently removes the selected log entries from this list.
• Search audit logs: Lets you search for a specific action, user, or entity within the log history.

When a reviewer asks what actions were taken during a cleanup or remediation exercise, search the relevant entries and export the results as supporting evidence.

Admin Settings: Your Control Panel

Do not miss out on critical findings

Notification Settings

Notification Settings lets you enable email alerts for critical violations so administrators can be notified when the app detects a serious data-security issue.

• Email Notifications (toggle switch): Turns email alerts on or off.
• When enabled: The system sends you an email alert to the current system admin whenever a critical violation is detected (for example, a serious data security violation).
• When disabled: No email alerts are sent. You'd need to check the dashboard or reports manually to see if anything critical was found.
• Notification Email: The email address that alerts should be sent to once Email Notifications is turned on.

During routine scanning, the app detects a critical sensitive-data violation. Instead of relying on someone to check the dashboard manually, the configured administrator receives an email and can investigate the finding.

Email Notification for Real-Time Scanning

Automatically notify users when sensitive or PII data is detected during real-time scanning. Based on the configured regex rules and remediation action, the detected data will be automatically encrypted or redacted, and an email notification will be sent to the user informing them about the detected violation and the action taken. This helps users understand accidental data-sharing mistakes and prevents similar incidents in the future.

Encryption Key Configuration

Control how encrypted sensitive data is protected

Encryption Key Configuration provides access to the settings used to protect sensitive information after it has been encrypted.

• "Manage encryption keys for sensitive data protection": Tells you this card relates to the security keys used when the tool encrypts (masks) sensitive information found in your Confluence pages.

Match Detection Rules To Your Unique Data Types

Regex Rule

You might store different types of sensitive data that standard patterns cannot identify. For this, you can use Regex Rules to control which detection patterns are active and create or test patterns for data specific to your environment.

Regex Rules tell the system exactly what to look for, like a credit card number format or a government ID format.

Choose which patterns your scans should use

• Enable All Regex Rules: Turns on every rule in the list at once, so all of them are actively used during scans.
• Disable All Regex Rules: Turns off every rule in the list at once, so none of them are used during scans.
• Create Rule: Opens a form to add a brand-new detection rule with its own name, category, and pattern.

Each rule includes:

• Rule Name: The name of the detection rule (for example, "American Express" or "AU Passport"), with the underlying pattern displayed underneath it for reference.
• Category: Groups rules by the type of data they detect, such as Financial (payment card numbers), Regional (country-specific IDs like driver's licenses, passports, or tax file numbers), Health (medical identifiers like a Medicare number), or Credentials (things like API keys and access tokens).
• Status (toggle): Turns that individual rule on or off.
• On: The rule is active and will be applied whenever a Data Security scan runs.
• Off: The rule is skipped during scans, so that type of data won't be flagged even if it appears on a page.
• Actions:
• Test: Lets you check the rule against sample text to confirm it correctly matches (or doesn't match) the data it's meant to detect before relying on it in a real scan.
• Edit: Open the rule so you can change its name, category, or underlying pattern.
• Delete: Permanently removes that rule from the list.

Tune detection rules before using them at scale

Testing a regex rule before enabling it across your environment helps you verify that the pattern matches the data you actually want to detect.

This matters because sensitive-data scanners can encounter legitimate content that resembles sensitive information.

Automation & Scheduling

A one-time scan gives you a snapshot after which your Confluence environment may continue to change. For instance, new pages, users, and sensitive information can appear between migration rehearsals or security reviews.

Use Automation & Scheduling to run recurring scans and automate selected actions instead of relying entirely on manual scans.

Automate Scanning

• Automatic Daily Scans: Turns on daily automatic scanning.
• When enabled: The system runs a full security scan every day at the time you set, without any manual action needed.
• When disabled: Scans only run when someone manually clicks a "Scan" button elsewhere in the app.
• Scan Time (time field, default 12:00 AM): Sets what time of day the automatic daily scan should run. This only matters while Automatic Daily Scans is turned on.

During a migration project, run daily scans so the team can continue identifying new findings instead of relying on a scan performed weeks earlier.

Automate selected cleanup actions

• Auto Deactivate (toggle, off by default): Controls whether inactive accounts get disabled automatically.
  • When enabled: Every time the scheduled scan runs, the system automatically deactivates dormant users and any users belonging to selected groups, without needing manual review.
  • When disabled: Dormant users are still identified and flagged, but nothing happens to their accounts automatically. You'd need to deactivate them yourself.
• Auto Encryption (toggle, off by default): Controls whether sensitive data gets protected automatically.
  • When enabled: Whenever the scheduled scan runs, the system automatically encrypts any sensitive data it finds, based on whichever regex rules are currently enabled.
  • When disabled: Sensitive data is still detected and flagged as a violation, but it stays exposed until someone manually encrypts it.

You can use scheduled scans to identify recurring issues and, where appropriate, automate selected actions such as dormant-user deactivation or sensitive-data encryption.

Set the point at which a user becomes dormant

Cleanup Thresholds

The dormant-user threshold defines how long a user must remain inactive before the app identifies the account as dormant.

• Dormant User Threshold (days) (default 90): Sets how many days a user must go without logging in before they're labeled "dormant" throughout the app (for example, on the Dashboard and User Analysis screens). Lowering this number makes the system flag inactivity sooner; raising it makes the system more lenient.

Different organizations may have different definitions of an inactive account. Set the threshold to match the period your administrators use when reviewing dormant users.

Automate carefully

Automatic deactivation and encryption should be configured deliberately. The consequences of a false positive can be greater when an action occurs automatically.

For sensitive-data encryption in particular, make sure detection rules have been tested before enabling automatic encryption.

Access

Control who should be able to use the tool

Control who is allowed to use the plugin itself and who is allowed to view sensitive data after it's been encrypted. It's about managing permissions for the tool, separate from Confluence's own user permissions.

Allow Plugin Access to Users

Control who, besides administrators, can open and use the plugin.

Select Users: Lets an administrator search for and pick specific Confluence users to grant plugin access to.

Role-Based Masked Data View card

Grants selected groups permission to view encrypted data on Confluence pages. Members of the selected groups will see a "View Encrypted Data" button next to the Edit button on pages containing encrypted content. Only administrators can manage and configure these group access permissions.

Control who can administer the app and who can view protected values, so you can delegate operational tasks without broadly exposing sensitive data.