How to govern Confluence
A step-by-step guide to governing Confluence with Rencore: detect with 28 policies, review with 13 reports, and remediate with 8 automations.
Governing Confluence means keeping its access, configuration, and lifecycle under continuous control rather than reacting after something breaks. Rencore governs Confluence with 28 pre-built policies, 13 reports, and 8 automations, so teams can detect risk, review posture, and remediate with an audit trail. The steps below turn that coverage into a repeatable routine.
Steps
-
Inventory Confluence
Connect Confluence and let Rencore build a continuous inventory of its resources, owners, and configuration, so governance starts from what exists rather than a stale export.
-
Detect with policies
Turn on the pre-built policies that cover Confluence to surface oversharing, sprawl, and misconfiguration on the first scan, before writing a single custom rule.
-
Review by owner and severity
Use the Confluence reports to review findings by owner, category, and severity, and to share them with stakeholders who do not have a seat in the platform.
-
Remediate and automate
Apply automations to fix findings at scale, route sensitive changes through approvals, and keep every action reversible and logged for the audit trail.
Recommended Confluence policies
Grounded in the Rencore catalog. See the full Confluence catalog on the Confluence connector page.
-
Space is publicly reachable (anonymous access)
Spaces open to anonymous users are internet-facing, raising the likelihood that any weakness is exploited.
Severity: High -
User account is active
Active accounts are live entry points, raising the likelihood that an access issue is exploited.
Severity: Medium -
App is enabled (live)
Enabled apps run live with their granted scopes, raising the likelihood that a weakness is exploited.
Severity: Medium -
Principal holds site system-admin grant
System-admin grants have site-wide reach, raising the likelihood that an access issue causes serious impact.
Severity: High -
Confluence space with anonymous access
Detects spaces that allow unauthenticated (anonymous) access.
Severity: High -
Confluence space editable by many users
Detects spaces where more than 50 users or groups have edit permissions.
Severity: High -
Confluence space without admin
Detects active spaces that have no space administrator assigned.
Severity: Medium -
Inactive Confluence user holding licensed seat
Detects active atlassian-type users with no login in the last 90 days.
Severity: Medium -
Active external Confluence customer accounts
Detects active customer-type accounts that may represent stale external access.
Severity: Medium -
Confluence page restriction granted to anonymous
Detects page-level restriction grants that include the 'anonymous' principal.
Severity: High -
Confluence global admin permission grant
Detects principals that hold the global 'confluence-admin' permission.
Severity: High -
Personal space of inactive user
Detects personal spaces whose owner is no longer an active user.
Severity: High
