Seeking input for Bulk Space Permissions

[dhur]

Hello Confluence Cloud Admins!

We're reaching out to the hive mind to get some concrete feedback on requirements for  Bulk Space Permissions functionality, a highly requested feature we are in the process of scoping and considering for nearer term roadmap. 

We'd love to hear from you about use cases in which bulk space permissions are needed:

• Task description (e.g. Add a new group to many spaces and configure permissions)
• When/Why 
  • Frequency 
  • Pain level on a scale of 1 to 7 (1 = annoying, 7=excruciating to the point it is not done)
  • (e.g. When a new team is formed due to company re-org: about 1-2 times a year, pain scales with how many teams are changed.)
  • (e.g. When new groups are created integrating Atlassian with our IDP: rare-hopefully just one time, pain is 7)
• Any other feedback you would like to share related to managing space permissions at scale.

We have not set a firm date for when this functionality would be coming, but will keep this group informed as we narrow in on requirements and finish scoping. Appreciate your help in advance!

Thank you,

Deborah (Confluence PM) & Kristen (Confluence Principal PM)

[Tere Pile]

great topic, give me a few days to throw a list together!

[Steve Rhodes]

I'd love to conribute but I feel that my efforts might be wasted if this is yet another feature that Atlassian will keep for Premium. 

[dhur]

@Steve Rhodes I'll flag this concern for folks who with be assessing edition. No decisions here have been made yet, and as we get better clarity on requirements/timing, we'll post an update. 

[Aron Gombas _Midori_]

Task description

Forge apps are represented by a provisioned user having the same username as the app in Confluence (I call it the "user app"). For the Forge app to be able to "work" in a space, the app user must have view/edit/etc. space permissions in the space.

When/why

In practice, Confluence users/space admins are having hard time to manage these permissions. They accidentally remove them, or they don't know about the provisioned user, so they just remove them. And when the permissions are missing, the app doesn't work, so they ask us, the developers. And we help them to re-add the permission...

Pain level

Pain level: 6 (sometimes they decide to skip it, because they'd have to solve it for all spaces one-by-one and that's a PITA)

It is extremely frustrating for the users using a Forge app, but it is even worse if they use multiple Forge apps where it becomes exponentially more painful. Also, it is inefficient for the developers/agents helping the customer to solve the problem.

I'd think if the popularity of Forge app grows, the problem will become more and more prominent.

Potential solution

I'd like to have a screen/feature/facility which tests in what space has a certain user a certain permission? Give me list in which the permission is existing and also where it is missing, and give me a button to (bulk-)grant it (assuming that I am admin of that space).

[dhur]

@Aron Gombas _Midori_ Thank you so much for the detailed summary! In general, would the app be granted permissions to all spaces or are there cases in which it would only be granted permissions to some and not others?

[Aron Gombas _Midori_]

@dhur I think the 99.9% of the cases would be "grant these 1-3 permissions to the app user on all spaces".

Not granting to some spaces is not necessary, because if someone wants to block the app from certain spaces, then instead of removing the permissions, using the upcoming "app access rules" feature is much more intuitive and standardized, IMO.

What do you think?

[dhur]

@Aron Gombas _Midori_ good call- I will do some due diligence to confirm that the app access rules feature will interact with our approach here in a sensible way, and also check in with our app partner community on needs. Very helpful to get a concrete data point that your common usage suggests it is sufficient to configure at a site level!