Skip to main content
Connect Asana to Oleria to gain continuous visibility into who has access to your Asana organization and what they can do. Oleria reads identity, membership, and audit data from the Asana API. It maps every user, team, role, and AI Teammate in one place, so you can find dormant or over-privileged access and act on it directly from Oleria.

​
What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your Asana organization or workspace:
  • Accounts - every member, admin, and guest, including view-only members, invited users who haven’t joined yet, and deprovisioned users (shown as disabled).
  • Teams - all teams and their members, with each member’s team role: team admin, member, limited-access member, or guest.
  • Roles - the built-in workspace roles (Admin, Member, Guest) with each user’s assigned role, and any custom roles your organization has defined on Enterprise+ plans, including the permissions each one grants.
  • AI Teammates - the AI Teammates configured in your organization.
  • Audit activity - audit log events such as logins, deprovisioning, role changes, security and SSO setting changes, and token revocations, attributed to the user who performed them. The audit log is available on Enterprise+ plans with a service account token.
Oleria refreshes this data on its regular sync schedule.

​
Prerequisites

Oleria connects with one of two Asana tokens:
  • An Asana Enterprise or Enterprise+ plan, on an Asana organization.
  • A super admin in Asana to create the service account.
  • Required for audit activity, which also needs an Enterprise+ plan (or Enterprise with the Compliance Management add-on).
You also need admin access on the Oleria platform to add a new integration.
The exact location of these settings can change over time. If the steps below don’t match what you see, refer to Asana’s service accounts and personal access token documentation.

​
Connect Asana to Oleria

1

Create a token in Asana

Service account token: Sign in as a super admin, open the Asana Admin console, go to Apps -> Service accounts, and select Add service account. Give it a name, and under Permission scopes select Full permissions: Oleria reads users, teams, roles, and the audit log, and needs write access to run remediation actions. Copy the token.Personal access token: Sign in as a workspace admin, open the Asana developer console (My settings -> Apps -> Manage Developer Apps), select Create new token, and copy the token.
Treat the token like a password. Anyone who has it can act in Asana with the permissions of the account that owns it. Asana shows the token only once.
2

Find Asana in Oleria

Go to your Oleria workspace, select Integrations, select the Available tab, and search for Asana.
3

Connect in Oleria

Select the Asana card and fill in the connection form:Select Authenticate. Oleria checks the token against Asana before saving the integration.

​
Verify the integration

Confirm the new instance appears on the Connected tab of your Oleria Integrations page with a status of Healthy. After the first sync completes, you can review the discovered accounts, teams, roles, and activity in your Oleria workspace.
If you revoke or regenerate the token in Asana, update the integration in Oleria with the new token by editing the integration.

​
Remediation actions

Beyond discovery, Oleria can act on Asana access to remediate risk. All remediation actions require a service account token or a workspace admin’s personal access token. Oleria checks this before running any action. A few safeguards apply to every action:
  • Oleria won’t deprovision the account that owns the integration’s token. Doing so would disconnect the integration.
  • A reversal only undoes the change Oleria made. If someone changed the same user in Asana in the meantime, Oleria leaves it as is.
  • If you provision Asana from an identity provider through SCIM, deprovision the user there too, or the identity provider may add them back.

​
Upgrading from the previous Asana integration

Earlier Asana connections in Oleria used a SCIM-based setup. Asana’s SCIM API only accepts service account tokens, so existing connections switch to the new integration automatically and keep syncing with their saved token. No action is needed. Editing the integration once in Oleria and selecting Authenticate converts it to the new format. You only have to edit it if Oleria reports that the token can see more than one workspace (enter the Workspace GID), or asks for an Asana access token.

​
Known limitations

  • Projects, portfolios, goals, and tasks aren’t discovered. This integration covers identities, membership, roles, and activity, not access to individual projects.
  • MFA and SSO status isn’t available. The Asana API doesn’t expose two-factor enrollment or SAML enforcement, so Oleria reports these fields as unavailable, not as disabled. Changes to those settings still appear as audit activity.
  • Teams require an Asana organization. Plain workspaces don’t have teams, so none are discovered there, and service accounts can’t be created for them. Connect a plain workspace with a personal access token.
  • Admins and super admins look the same. The Asana API reports both as admins.
  • Custom role holders aren’t shown. Asana lists custom role definitions but not which users hold them, and roles can’t be changed through the API.
  • Personal access tokens, service accounts, and authorized apps aren’t inventoried. Asana doesn’t list them through its API. Their creation and revocation still appear as audit activity.
  • Audit activity requires a service account token on an Enterprise+ plan. Asana keeps audit events for 90 days.

​
Contact us

For questions about this integration, contact us at support@oleria.com.