Bitbucket: Administrator Permissions

[wgroenewald]

In Bitbucket Cloud we have a team setup and we have a group called Administrators who have team permissions to "Create Repositories" and "Administer Team".

In the create a new group popup dialog box I see under the "Administer Team" check box there is the following text: 

"Admins can update team settings and administer repositories"

If I enable the "Administer Team" option, is there then any reason to have the "Default Repository Access" option set to "Admin"?

I want Administrators to have full access to every repository within the team, but I'm not sure if I need both "Administer Team" checked as well as have the "Default Repository Access" option set to "Admin". It seems a bit redundant, and I'm not sure if they do the same thing.

[Paz · Accepted solution]

Administering a team involves adding/removing members and changing other settings, like the name of a team.

Administering a repository involves changing the configuration of an individual repository.

Repository admins don't need Administer Team permissions.

[wgroenewald]

Thanks for your answer, but my question is more - is there anything that the repository administrator can do on his/her repo that the Administer Team admin can't do?

 Does the Bitbucket Admin (with Administer Team permissions) have the ability to read/write from all repositories within the team, even though the Bitbucket Admin may not have any specific permissions on the repo itself?

[wgroenewald]

I did some testing and determined that:

The Bitbucket Team Admin (BTA) group needs to have admin rights on every repo within the team if he wants to manage the users within that repo. If groups are added to the repo then the BTA can of course move users in and out of the groups, but not change the groups associated to the repo itself.

The BTA has no visibility of repositories that he/she is not specifically given permissions on in the repo's "User and group access" page.

That means repo owners could potentially remove the BTA group from their repo - effectively locking out the BTA from assisting.

Only fix for this would be to:

1. Go to groups and select the Administrators group
2. Click the three-dots (…) menu in the top right corner of the groups page and click “Update repository access”
3. Select "All repositories that <team name> owns” and “Admin”
4. Click update

Are my findings correct?