Restrict Data Access for Apps/Plugins

[Ole Rosendal]

Hi.

Trying to figure out if it is possible to restrict data access to App/plugins. 

We have Scriptrunner and EazyBI installed.

Can we limit which projects these apps can access?

Example:

Project/Space "A" is public for all users. Project/Space "B" is restricted via special special user groups. User "X" has public access, and user "Y" has public and part of special user group to see "B". 

When X goes to create a filter in Scriptrunner or Dashboard he/she must only see data from "A". When Y do the same he/she can see both A and B data in both apps. 

Is this possible to do? 

[Gor Greyan · Accepted solution]

Hi @Ole Rosendal

Welcome to the Atlassian Community!

In general, marketplace apps like ScriptRunner or eazyBI respect Jira’s permission model, so they can only access data that the user is allowed to see.

The correct way to control access is via project permissions, issue security, and group membership — if user X can only see project A in Jira, the apps will follow that and only expose data from A.

[Ole Rosendal · Accepted solution]

Thank you. 

[Aron Gombas _Midori_ · Accepted solution]

The general answer is what @Gor Greyan wrote, but there is an additional layer: app access rules. Using these you can control which Jira spaces can be accessed by the apps themselves.

[Marita Burgio - eazyBI support]

Hi @Ole Rosendal

Just to add some clarification, specifically for eazyBI:

eazyBI imports data using a single authorized user account. This means it can only import data from the projects that this authorized user has access to.

The Jira permissions of the authorized user are applied to the imported data. For example, if projects A and B are selected for import, but the authorized user only has permission to view project A, then only project A will be imported.

As a result, all users with access to that eazyBI account will only see data related to project A.

To properly restrict access in eazyBI, you should either
1) Create separate eazyBI accounts for different teams. Each account would have its own authorized user, configured to import only the relevant project data. Users added to that account would then only see data from those specific projects.

2) Use Data access roles within a single account - assign roles to specific users or user groups to limit which cubes, report folders, dashboards, or even specific dimension members (e.g., only certain projects) they can access.

I hope this helps!

Best regards,
Marita from support@eazybi.com