Is it possible to restrict Jira Admins from accessing specific projects (spaces)?

[Simeon Adimula]

I have a space with confidential information that Jira admins should not have access to. Is there a way to handle this apart from removing their admin access?

[Ollie Guan · Accepted solution]

Hi @Simeon Adimula ,

In the Jira permission ecosystem, "Trust" is the cornerstone of the design.

Jira's logic is that System Administrators (Jira/Org Admins) are "Super Users" responsible for the instance's integrity. Consequently, there is no purely technical way to achieve absolute, unbypassable isolation from admins within the same instance.

• The Nature of Technical Restrictions:

  • Permission Schemes and Issue Security are indeed "entry-level" or "configuration-level" shields.

  • While admins are "locked out," they hold the tools to "change the locks." They can modify these schemes at any time to regain access.

• Compliance and Deterrence:

  • The Audit Log is immutable (admins cannot delete specific log entries).

  • The Solution: Organizational Policy + Regular Auditing = Compliance. By auditing admin actions, you ensure they do not abuse their power to bypass restrictions.

Recommended Action Framework

• Low Sensitivity: Modify Permission Schemes to prevent "accidental viewing" during daily tasks.

• Medium-High Sensitivity: Enable "Issue Security Levels" + Establish a monthly audit process (reviewing permission change logs).

• Extreme Sensitivity (e.g., M&A, Executive Payroll): Spin up a separate site to achieve physical permission isolation.

[Cyrille Martin]

Hello @Simeon Adimula,

Yes, it is possible to restrict access to specific projects to administrators through the permission scheme.

Nonetheless, since they are instance administrators, they can unfortunately grant themselves access again if they choose to.

However, this action will be recorded in the instance audit log, so you will be able to see if an administrator intentionally restores their access to the project.

Regards,

[Simeon Adimula]

Thanks for your response. I completely agree that permission schemes can be used to remove administrator access to a project.

What I am really about is preventing instance administrators from simply granting themselves access again. While the audit log provides accountability after the fact, it doesn't prevent access in the first place.

I'm interested to know whether there is any mechanism, native or otherwise, that allows project-level access restrictions to be enforced even for Jira instance administrators, or whether this is simply a limitation of the current Jira security model.

[Arkadiusz Wroblewski]

Hello and welcome to Atlassian Community @Simeon Adimula 

For sensitive data Isolate the Work, move highly sensitive projects to a completely separate Atlassian site or organization with a dedicated admin group.

Best,

Arkadiusz🤠

[Simeon Adimula]

Thank you Arkadiusz!