User isolation

[Vladimir Bondarev]

Hello,

I would like to clarify whether the following level of user isolation is possible in Jira Cloud.

Let's assume our organization has 100 users.

We want to create a separate project for a small group of 3 users. These users will work only within that project. A few additional users (for example, 3 managers) will have access to the project only to create and manage tasks for them.

Our requirement is very strict:

• The 3 users should only see their own project, board and issues.

• They should not be able to see any other projects in the organization.

• They should not be able to see other users in the organization outside of the people they interact with in their project.

• They should not be able to browse the People directory, Teams, Organization members, user pickers, mentions, or any other place where other users may be visible.

• Ideally, they should only see the few users who can assign work to them.

The reverse should also be true:

• Regular users in the organization should not be able to see these 3 users unless they have access to the project.

• The existence of these users should be hidden from the rest of the organization as much as possible.

In other words, we are looking not only for project-level isolation, but also for user visibility isolation.

Is this achievable within a single Jira Cloud site and Atlassian Organization using Jira Standard/Premium permissions and administration settings?

Or would this require a separate Jira site / separate Atlassian Organization?

Any guidance or documentation references would be appreciated.

Thank you.

[Trudy Claspill]

Hello @Vladimir Bondarev 

If your company has an Enterprise plan, another option available to you is to create another Site within your Organization. For the users and project that need to be isolated, grant those users access to only that second site. Don't grant any other users access to that second site. 

Users can access the data and see the other users only for the site(s) to which they have access, and within that site. 

If the isolated users are granted access only to the secondary site, the will show up in the user picker lists only for that secondary site. And no other users except those with access to that site will show up in the user picker lists in that site.

The one exception to seeing the other users might be in places where users can be invited to the site, such as the Add People section for a project. If end users or project admins are allowed to invite people to their projects, they might be able to see the otherwise isolated users because those users are members of your Organization. I'm not sure about that.

If you don't have an Enterprise plan, you could consider setting up an entirely separate second Organization to isolate that small group of users and their project.

[Nikola Perisic]

Hello @Vladimir Bondarev 

This can be achieved with company-managed Jira space that uses permission schemes. As you mentioned the isolation of users to be seeing only the space that they need to see, you would add them to that Jira space and assign them the role. You need to make sure that those users are included in Browse projects permission. They will only be able to see this one space and not others. 

As for the user level isolation, this doesn't work with native Jira features. When you are using a user picker field, it will show you all users that are available. You can try with ScriptRunner as it has more options to hide the values from a certain field, which would be suitable for your use case.

[Vladimir Bondarev]

Hello @Nikola Perisic,

Thank you for the clarification.

Regarding ScriptRunner, do you think it would be possible to achieve this level of isolation with it?

Specifically, our goal is not only to restrict project access, but also to prevent these users from seeing other users in the organization.

[Nikola Perisic]

@Vladimir Bondarev 

Using a custom user picker field that would be limited with ScriptRunner I see as possible. Other than that, there is no real way of limiting the users to be shown from the whole organization.