How to restrict "browse project" permissions if it is grated to "All members for directory" group?

Question

We have 800+ AD groups that are provisioned for Jira access and since we cannot add every one of them manually for Browse projects permission, we provided access to "All members for directory ..." group created by Access. This permission is the same for 500+ projects. Now we have some users who have to be restricted only to certain projects and they should not see other projects, is there some way I can achieve this. The only possible solution that I figured out was to create the users manually as they will not be a part of the all members for directory and we can create a new permission schema for those projects including these non provisioned users.

But I do not want to manually create users and would like to provision them too, any one had a similar issue and found a fix?

It would be great if there was also a "Deny" option along with the "Grant" in the permissions!

Praveen · Answer

Thanks for the response Sachin, the problem is each project uses their own AD group and they use it for restrictions/access within their project. Also Access doesn't support nested groups so I cannot sync both the parent and child groups.

I am working on a different solution and I am close, will post updates when I finalize it.

Sachin Dhamale_o1c5zi · Answer

@Praveen

First of all you need to figure it out all the project share same AD groups. accordingly you need to create common AD group which will include all other small AD groups. and use that common AD group for those group.

like you mentioned some of the user you need to restrict - for that you can create a different jira internal group with user you want to give permission OR Create project role there you can add the common AD group/user/internal jira group which you want to give permission to the project. - Then add those project role to the browse project permission.

Project role will be the best practice to manage permission. also you can create jira internal group for the user which belongs to different AD groups

Pls Accept the Answer if it helps :)