Add New Users to existing Space and Restrict their View

[Jericho Sison]

Hi,

I was trying to add a test account (for the meantime) to an existing space using the space role I just created. My intention is to limit the view of that new user to that space only, limiting all the access to any service management/team-managed software spaces.

In doing this, I followed the article below. However, the result is that I couldn't see all the service management spaces, even the one where I add the user - but I still can see all the team-managed software spaces.

Any other options or are there remaining configurations that I haven't setup? Thanks.

https://support.atlassian.com/jira/kb/restrict-project-access-to-certain-groups-or-users-in-jira-cloud/

[Trudy Claspill · Accepted solution]

Hello @Jericho Sison 

Let us first talk about Company-spaces.

For a user to be able to see the content of such a space the user must have the Browse Projects permission within that Space, which is determined by the Permission scheme used by the project. 

To prevent the user from seeing the content of other Company-managed Spaces you have to ensure that the user does not have the Browse Projects Permission in those spaces.

Permissions can be allocated to user groups, project roles, individual users, to "any logged in user", and more options. You have to consider that when figuring out how to grant access to the one project and not others.

When you were following the article instructions did you make sure that:

1. You added the user to a role in the desired space
2. You added the role to the Browse Projects permission in the Permission Scheme associated with that Space?

Now let us talk about Team-managed spaces.

Each one has an Access setting of Open, Limited, or Private. Any logged in user can see the content of Team-managed spaces that are set to Open or Limited. If you want to prevent the user from seeing all or all but one Team-managed spaces, the ones they should not see need an Access setting of Private. The users who do need access to those projects then must be specifically added to those spaces.

The article you referenced does not provide instructions for "hiding" the Team-managed spaces.

[Jericho Sison]

Hi @Trudy Claspill

Thanks for this.

To confirm, yes I added the user in the desired space using the new space role I created. Second point, I might have skipped this because I thought it would allow them to access other projects. I will change that.

Noted as well on your advise on Team-managed spaces.

[Trudy Claspill]

If you did not grant that role permissions for that space, that would be why the user can't see that space.

Adding a Role to a Permission will grant that permission to the members of the Role on a per space basis. If a given space has members in that Role, and the Role is granted permissions in the Permission Scheme used by that space, then members of that Role in that space will get that permission. They don't get that permission in other spaces if they aren't in the role in those other spaces and aren't in another group/role granted that permission in those other Spaces.

[Arkadiusz Wroblewski]

Hello @Jericho Sison 

@Trudy Claspill already found the main missing piece here.

For the service management project, adding the test user to a new project role is only half of it. That role also needs to be granted Browse project (and any other needed permissions) in the permission scheme used by that project. Without that, the user can be in the role and still not see the project at all. 

For the team-managed projects, the article you linked does not really cover those. Their visibility is driven by the project’s access level. If they are Open or Limited, your test user can still see them. If you want the test user to see only one project, the other team-managed projects would need to be Private. 

So from what you described, I would check these two things:

- add the new role to the target service project’s permission scheme

- make the other team-managed projects Private if you do not want them visible to that user 

That should let you keep the existing access for everyone else, while limiting only the new test user the way you want.

[Benjamin]

HI @Jericho Sison ,

Let's separate you and the user. The user you added to an existing space with a new role.... is that user able to see that existing space and what is that space? is it a team managed space or a service management space. 

What is the expectation you wanted with your user and what is the expectation for other users? You mention you see all team managed software spaces but only some service management space. Were you expecting to see service management spaces?

For the other users, what are trying to restrict? For example, only see the space that you just assign?

Thanks!

[Jericho Sison]

Hi @Benjamin 

1) The new user i added cant see the esiting space. The existing space where I added the user is a service management space.

2) I'm expecting the new user, with the newly created space role, to only see the specific space where I added it. Rest of the spaces shouldn't be visible whether they are team-managed or service management.

3) For other users, no changes. They should still be able to access everything. For context, I'm using a test account so that once I get the configuration right, I will add 2 more users.