Please help me understand Form access in Jira work-management

[Laura Bennett]

I have a team responsible for organising work events at my company who use a team-managed Jira work management project. 

The use-case seems simple on the surface, they want employees to have the ability to create work items to their project but not permission to view other work items in their project.

I set this up originally with an employee role that only had the Create issues permission assigned - however, I learnt that adding any permission also comes with an unspoken View issues permission.
So, to prevent them from viewing any work items I had to remove the employees from the project access completely. 

Not to worry, I thought, I can use forms instead.

On the documentation from Atlassian there are three access levels:

• Limited access: Only people with permission to create work items in your space.

• Open access: Only people with a Jira license who are able to log in to your Jira site.

• Public access: Anyone online with the link can submit a response to the form. (This option won’t be available if an admin has disabled public access on your Jira site.)

All our employees have a Jira license, so I would have thought that Open access was enough, but it wasn't. I submitted a ticket to Atlassian because I was convinced this behaviour was a bug but they assure me it's expected behaviour.

This was their response:

If the form is kept as Open and the Space is kept as Private then only the users who have access to Space will be able to access the form.

ℹ️ The same information will also be present in the info panel on top of form builder which indicates user should have access to space if they need to submit the form if the form is kept as Open. You can see the screenshot from my test instance

I've read this message more times than I can count and I can't make sense of it.

The screenshot showed the following message at the top of the form:

To allow people in the site to submit this form, make sure the selected owner has access to the space and all of its work items. 

Who is the selected owner? The owner for the form, the owner of the project, or the owner of the request?

In the end, the workaround Atlassian support provided was to set the form to Public instead and allow public access on your Jira site. This seems too open in my opinion as the Events team don't need to collect requests from the public and there should be no public access to our site, I thought it was working however, so I closed my ticket but now still even with this level of access the employees don't have access to the form. 

Can someone explain this to me like I'm five? What's the benefit here to having three access levels if anyone wanting to use an Open or Public form also need create (and therefore view) permissions to the project?

[John Funk]

Hi Laura,

This is one of the problems of working with Team-managed projects. I suggest you create a simple JSM project for the intake. Then create an automation that clones the ticket into the Team-managed project. 

[Laura Bennett]

Thanks for the suggestion. I get that rebuilding this as a JSM or company-managed project would give me more permission config options, that's probably the long-term fix.

But I'm trying to understand why the current behaviour exists in forms. The documentation and descriptions in product suggest that in "Open" form access any licenses user on the site or with "Public" anyone with the link should be able to submit a form, even if they don't have project access, but that's not the case.

So, I'm less stuck on how to work around it and more trying to understand the reasoning and uses behind the access levels.

[John Funk]

Did you complete the rest of the requirements in the documentation for Public Access Requirements and Turn Public Access On?

[Laura Bennett]

Yes I did. The issue seemed instead to be that the links need to be newly created via Share > Copy link, the form URL changes depending on the form access. 

[John Funk]

Yes, I have seen that. Did that fix it for you? 

[Laura Bennett]

 Yes, in a way. With the new link employees could see and submit the form, so technically it worked. But I agree with @Marc -Devoteam- switching the site to Public isn't a secure workaround. We don't allow external access to our site so we needed a fix that doesn’t compromise the rest of the site.

But I think I’ve finally pieced together what’s actually happening here, so I'll share it in case it helps anyone else.

---

Open access: Only people with a Jira license who can log in to your site.

The hidden catch is this: the form creator must have Create permissions in the project. That’s why the banner says:
“To allow people in the site to submit this form, make sure the selected owner has access to the space and all of its work items.”

The “selected owner” is the person who built the form, not the requester, not the project lead.
If the form owner has Create permissions, then any licensed user can submit the form via Open access, even if they do not have Create permissions themselves.

---

Public access: Anyone with the link can submit the form.

Another quirk I didn’t realise at first:
When you change a form from Open to Public, the share link regenerates.
You can’t reuse the old Open-access link for Public mode, you have to copy the new one.
A couple of other quirks about public access are:

Public form links aren’t smart links, so you can’t embed them neatly in Confluence or get the preview behaviour. They are just plain URLs.
Public forms don’t capture the reporter, even if the person submitting has a Jira license and is logged in. Instead, you have to set a default reporter on the form, and the actual submitter’s email just gets dropped into an email field on the form, but this is well documented.

In the end, the issue in my case was that even though the project is team-managed the team still wanted help from a Jira admin (me) to build the forms. So we had a scenario where the creator of the form didn't have create/view permissions to the project.

The fix was to grant myself (the "selected owner") create/view permissions to the project.

[John Funk]

All of that being the case, you would be better off create a JSM project and using it for intake. Then you can clone the ticket into your Jira project, link the two work items, and control who has access to submit the tickets. 

[Matteo Vecchiato]

If you don't have JSM, a solution could be a standard Jira conpany-managed project and you can configure accordingly the security level to manage who can view the work items.

You should set automatically the security level to the work item and security schema should be configured to let access to:

Reporter

Group that can view all the work items.

I hope it helps 

[Marc -Devoteam-]

Hi @Laura Bennett 

In agreement with John.

Forms on non JSM projects can only be used by licensed users and they need access to a project, on team-managed this means the users need a access to the project.

On a company managed project the browse and create permission would be required, as without browse permission the project is not visible and issue creation can't be done.

The main reason is this, do you not want the user to see his own created issue?

[Laura Bennett]

Thanks for the explanation, I'm still confused about the logic of the forms access though. If users still need access to the project to submit a form, then "Open" or "Public" access doesn't seem to offer any practical difference from "Limited". So I'm just trying to wrap my head around how the access levels differ and the use cases for each?

[Marc -Devoteam-]

Hi @Laura Bennett 

Related documentation can be found here; https://support.atlassian.com/jira-software-cloud/docs/share-your-form/ 

1. Limited access: Only people with permission to create work items in your space.
2. Open access: Only people with a Jira license who are able to log in to your Jira site.
3. Public access: Anyone online with the link can submit a response to the form. (This option won’t be available if an admin has disabled public access on your Jira site.)

Both options 1 and 2 require a user to have a license.

Option 3 requires to go to the General Settings in Jira admin and enable the option: Allow users to share dashboards and filters with the public"

Keep in mind that any filter or dashboard that is open to the public or made new can then be viewed. So this could be a security risk.

You would need to go over each filter and dashboard and any new filters and dashboards and existing ones would need to be reviewed regularly.

So I won't recommend option 3 at all, based on security