Permission

[torben]

Can anybody explain the permission rules in confluence? 

What is product access? 

What is side access? 

What are side-admins compared to an administrator? 

What are groups and what are teams and how to administer their access to pages and/or spaces?

What is space & page access compared with side access? 

What happens if I grant somebody space access through a group, but kick him/her out of product access? 

Is "confluence-user" just a standard group created by confluence? 

Please explain it as you would need to explain it to my 90 years old grandma as the documentation is not really helpful. 

[Shannon S]

Hello Torben,

Happy to help you with this! I'll explain best I can and just let me know if you have any questions about any of this. I'll be including my sources below, just for reference.

1. Product Access allows you to control which Atlassian products a user can have access to. So for example, if you want a user to be able to use Confluence, but not Jira, then you could give them only Confluence product access. (ref: Groups and Product Access, Update Product Access Setting, How Users Get Site Access) 
2. Site Access allows you to say who can login to your site overall. You need to have site access to login to the Cloud site, but you don't necessarily need to have Confluence product access if you only want to work with Jira. (ref: Specify how users get site access)
3. Site Administrators (site-admins) vs Confluence Administrator: Site admins are higher up than Confluence admins. Site admins can manage the users and groups for a Cloud site via admin.atlassian.com. Confluence admins can only access the Confluence permissions and make changes there, in the *.atlassian.net/wiki/admin section of your site. (ref: Give users admin permissions)
4. Groups vs Teams: Groups allow you to manage the permissions for a specific set of users, rather than individually. So if I needed everyone in my billing team to be able to access a specific page in Confluence, but not anyone else, I would just make sure that I created a group, for example, called billing, and then set a permission that says "only people in the group billing can see this page. Teams, on the other hand, are new and currently aren't related to permissions. A team is just a way you can collect your users from one physical team in a single place in Confluence. You can use this to see what the team is working on, for example. (ref: Atlassian Teams, Create and Update Groups)
5. Manage Group Permissions: You can manage group permissions either globally (the entire site), or per space only. You can find information on where to find those settings from our documentation: Global Permissions Overview and Assign Space Permissions You just need to edit the settings in those pages and add the desired permissions there.
6. Space and Page access vs Site access: As I described site access above, page and space access are more granular. You can allow a user to have site access, but not access to a specific space (a collection of pages), or page. It all depends on what access you want them to have. (ref: Assign Space Permissions, Add or Remove Page Restrictions)
7. If you were to grant someone space access through a group, but remove their product access, then they can't use Confluence at all, and it won't matter if they have access to the space via the group.
8. confluence-users is indeed a default standard group created by Confluence. When a user is member of the confluence-users group, then they are granted Confluence product access.

A lot of this is easier to see than to read about, so I would recommend that you check out one of our online training resources to help walk you through all of this. 

Let me know if you have any questions.

Regards,

Shannon