Atlassian Enterprise - How to limit user access to certain sites?

Yassin BEN-NACEUR _FlowZess_

Hi everyone, 

I have a question concerning Atlassian Cloud Enterprise.

My customer has Atlassian Enterprise with multiple sites. The users are provisioned using Atlassian Access and Azure Active Directory (they are all in single directory). The customer has multiple sites. 

 

How to limit user access to certain sites. User A should have only access to site1. So if I go to site2 and try to mention the user or assign him a ticket, the user should not be visible. The user must not be able to access the site2. 

Thank you for your answers.

Nic Brough -Adaptavist-

Atlassian does not do general access by restriction, it does it permissively.  That is you say "this person can", rather than "this person can not".

To do this, the applications all have a simple rule - they have a list of user groups that say "a person in this group is a user of this application".  By default, the applications have a single group for this, and it's usually clearly named - confluence-users, jira-software-users etc.

In a multi-instance site such as yours, if you've gone with the defaults, then you'll have set up a situation where all your people are in a set of directories that name them as "jira users".  It's quite likely that Jira-1, Jira-2 and Jira-3 are all using the default "jira users" group, so everyone who needs to use any of your Jira systems is added in that group and hence ends up with access to all of them.

To change this, you'll need to do some restructuring.  By all means, leave the jira users group as it is, but for a Jira system that should not be letting some people be users, change the access model.  Set it up so that it only recognises people of a different group as being its users.  I mean, do something like create and populate groups like jira-1-users, jira-2-users, jira-3-users, and then change Jira-1's "application access" so that it uses jira-1-users to say who can use it, and similarly for the others.