App management and integrations

1. Navigate to the admin console
2. Click Apps
3. Click Manage apps
4. Navigate to the Connected apps tab. You'll see a list of all the apps connected, their last activity and active members.
5. Click Export CSV for a list with user specific activity. The list includes user email addresses, how many times they've used the app in the last 90 days, and the last date they've used the app. The CSV file will be emailed to the admin who exports it.
   
   

Clicking on the app will show you:

1. Brief description of the app if available
2. The developer and support or privacy policy links the developer may have supplied
3. Recent usage stats
4. Permissions granted to the app

A super admin should decide how they want to manage apps. There are 3 main modes of control.

Allow all apps (default)

Admins can manage a list of blocked apps, otherwise all apps can be used by default

Require app approval

Admins manage a list of approved apps. Apps cannot be used unless it is on a list of approved apps.

External automation permissions

Admins can allow or disallow rules from being triggered by web requests from external services.

1. Navigate to the apps page of a specific app from the Connected apps page
2. Click Block app

This will prevent all users in the domain (members + guests) from connecting and using these apps. Existing users may see errors and the app may cease to function. For users in multiple domains, the block will prevent them from using the app in any of their domains

If the organization is in the “require app approval” mode, users will be prevented from connecting any apps that are not on the approved list which super admins can manage. Users will instead see a message with an option to request admin approval.

If the user clicks Send request, an email will be sent to the desired email addresses as configured on the global app settings page. By default this is all super admins but can be configured.

The admin will receive an email similar to the above example. Clicking Manage app in Asana will take the super admin to the app details page to approve the app.

The requesting user will also receive an email letting them know that their admin has been notified. The user’s email address is also included in the app request email. We recommend having a process in place to monitor requests that come in and/or notifying users on what the next steps may be depending on how your company handles this.

Organization admins can view a list of all apps that have been requested. To view all approval requests:

1. Navigate to the Admin Console and click on Apps in the left bar.
2. Select Manage apps and choose the Approval requests tab.

Personal access tokens (PAT) can be used by users in the organization to create their own scripts and automations. PATs have access to whatever the creator has access to. A list of active personal access tokens that have access to your organization, the user that created it, and the last time the token was used in your domain can be viewed on the Personal access token page.

Admins can revoke personal access tokens on demand by clicking the Revoke button. Once you revoke a PAT, the token will be deleted and can no longer be used. The developer who created the token will receive an email letting them know their PAT has been removed.

PATs can be turned off or on for the domain from the Global app settings page.

Turning off PATs will cause all existing personal access tokens belonging to users in their organization to be revoked and blocked. This may cause disruption to users so super admins should let users in their organization know before this is done.

Set default expiration for personal access or service account tokens

Super admins of Enterprise organizations can set a default expiration date for all personal access tokens or service account tokens that users create in their organization.

Tokens have a default expiration of 10 years. However, super admins of Enterprise organizations can set tokens to expire within either 30, 60 or 90 days.

How can I change the default expiration date?

1. Navigate to the Admin Console and select the Apps tab.
2. Under Global App Settings you will find two options for setting expiration times under Token expiration.

Additional notes:

• If a new option is selected, all existing tokens will have the new expiration policy applied.
  • For existing tokens: if an expiration date of 30 days is selected, tokens created in the past will be set to expire 30 days from when the policy is set. 
  • Newly created tokens: all newly created tokens will be set to expire 30 days after they are created. 
• If a member with existing tokens is added to your organization (like a guest), those tokens will expire immediately. 
• If an expiration date is set, developers will get a warning 7 days before their token expires along with a warning when the token expires.
• If the token expiration is set to 30 days and is then extended from 60 or 90 days, or back to the default, the token will expire within the original 30 day policy. Asana will not push the token dates out. The expectation is that the strictest expiration setting will apply and newly created tokens will follow the new policy’s expiration date. 
• However, if an expiration date is reduced, (from 90 days to 30 days for example), the token will expire based on the stricter, 30 day expiration.