Grant user permissions to create/edit automations without admin rights

[kate reeder]

Hi folks - I am using Jira Software on the Cloud and company-managed projects. I want to give a user permissions to be able to create and edit automations, but only for one project. It sounds like I can only give him this access if I make him an admin, but I'm concerned that admin rights could put us at risk because we're using company-managed projects and several projects share settings (things like workflows, custom fields, etc). Can I grant this user permissions to create/edit automations on a single company-managed project, without also giving him permissions to edit other settings that are shared between projects (i.e. workflows, custom fields, etc)? 

[kate reeder · Accepted solution]

tested and confirmed - Creating a project role with the Administer Projects permission gives the user ability to create/edit automations, but only for the projects that that user has access to. By default the user is not able to edit any global automations or automations shared with other projects for which the user does not have Administer Projects permissions. I also confirmed that by default users with this permission setting are not able to edit workflows or screens. This applies to company-managed projects on the cloud. 

[Rebekka Heilmann _viadee_]

Hi @kate reeder 

Permissions for Automations are tied to Project Admin Permissions. A project Admin can only create Automations that are in the scope of that specific project. They cannot create global rules.

Regarding Workflows and such: Project Admins can only edit Workflows, Screens etc. if they don't share their Configs with other projects and only if you grant them "extended project admin permissions". That is a checkbox in the Permission scheme.

So granting Project Admin permissions should not worry you as per your description.

[kate reeder]

Thanks, @Rebekka Heilmann _viadee_  - Do you know if the EPA checkbox is available now in the Cloud instance? I'm not seeing it and when I search on this in the community I'm only finding a post from 2019 indicating that it's not yet avail for Cloud.

[kate reeder]

For anyone else following this thread - I was not able to find the EPA checkbox in my cloud instance. It appears that in cloud creating a project role with Admin rights will give the user the ability to create/edit automations and by default they are not able to edit any global automations shared with other projects, and also not able to edit workflows or screens. I tested this to confirm.

I'm not sure if there's a way to grant extended project admin permissions in the cloud environment. For my use case, I got what I needed so have concluded my research. 

[Rebekka Heilmann _viadee_]

Ah sorry - I've not double checked that before posting. I know for a fact that they can change the Issue Layout, but not tested anything else as we deprived them of their EPA rights before migration anyway ;) 

[Bill Sheboy]

Hi @kate reeder 

I believe there is a option to add / remove permissions for a Project Admin to manage rules, but there is no option to allow rule management for non-Project Admin users: 

https://support.atlassian.com/cloud-automation/docs/permissions-required-for-jira-cloud-automation-rules/

Kind regards,
Bill

[kate reeder]

thanks, @Bill Sheboy it sounds like the only way I can give this user permissions to edit automations is to make them a proj admin. As a proj admin on a Cloud instance, will he also be able to edit workflows, screens, and custom fields? Or can only global admins edit these things? 

[Bill Sheboy]

That depends upon the project type...

For company-managed projects, I believe what @Rebekka Heilmann _viadee_ noted applies.

For team-managed projects, the configuration is by-project, and so the project admin can do almost anything.  The exception is modifying site-defined (i.e., global) custom fields which the team-managed project happens to use.

[kate reeder]

FYI - I tested it and confirmed that creating a project role with Admin rights will give the user the ability to create/edit automations and by default they are not able to edit any global automations shared with other projects. I also confirmed that by default they are not able to edit workflows or screens. Huzzah! ...that's exactly what I needed. Appreciate you sharing information! Helped point me down the right path :)