> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-asana.md). # Onboard Asana For SaaS Security to detect posture risks in your Asana instance, you must onboard your Asana instance to SaaS Security. Through the onboarding process, SaaS Security connects to the Asana API by using an API token that you generate from the Asana admin console. After connecting to the Asana API, SaaS Security scans your Asana workspace for misconfigured settings and account risks. The supported Asana account plans for SaaS Security scans are: * Enterprise+ * Legacy Enterprise To access your Asana instance, SaaS Security requires the following information, which you specify during the onboarding process. | API Token | A service account token that Asana generates for a service account that you create. The token is an alphanumeric string that SaaS Security uses to authenticate to the Asana API and leverage the service account's permissions. | | --------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | To onboard your Asana instance, complete the following actions. *** ### Step 1: Create a Service Account in Asana and Save the Token An Asana service account is a non-human, programmatic identity that SaaS Security uses to scan your Asana workspace. When you create a service account, Asana generates and displays a service account token that SaaS Security uses to access the Asana API. Asana displays this token only once, so copy and save the token so you can provide it during onboarding. 1. Open a web browser to the [Asana website](https://asana.com) and log in as a Super Admin. **Note**: To create an Asana service account, you must use an account assigned to the Super Admin role. Service accounts are an exclusive feature for organizations on Asana's Enterprise or Enterprise+ plans. 2. Navigate to the Admin Console. Locate your profile picture in the upper-right corner of the Asana webpage and select \ > Admin console. 3. In the left navigation pane, select Apps > Service Accounts. 4. On the Service Accounts page, click Add service account. 5. Fill in the Add service account dialog: * Specify a Name for the service account. For example, SaaS Security Service Account. * Under Permission scopes, select Full permissions. 6. Click Save changes to generate the service account token. Copy the service account token and paste it into a text file. **Important**: Do not continue to the next step unless you have copied the service account token. You must provide this token to SaaS Security during the onboarding process. *** ### Step 2: (Optional) Update the Token Expiration Period By default, the lifespan for service account tokens in Asana is 10 years. To limit the attack window if the token becomes compromised, set service account tokens to expire after 90 days. 1. From the left navigation pane in the Admin Console, select Apps > Service Accounts. 2. On the App settings page, locate the Token Expiration settings. 3. For When should service account tokens expire? setting, select 90 days. 4. Click Save changes. *** ### Step 3: Connect SaaS Security to Your Asana Instance By adding an Asana app in Cortex, you enable SaaS Security to connect to your Asana instance. 1. Log in to Cortex. 2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to. 3. Click the Asana tile. 4. Under **Capabilities**, Enter a Name for your application. 5. Select Security Posture under **Default Capabilities** and click Next. 6. Under **Connections**, provide the Tenant ID, Client ID, and Client Secret. 7. Under **Configurations**, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments. 8. Click **Next** to complete the onboarding validation process. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-asana.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.