Grant project administration permission excluding the right to add/remove user to the project

Question

Dear community

In regard to enable e.g. Project Leads to administrate their project without needing admins the whole time we would like to grant some people (a specific group or the role project lead) the needed permission. 
BUT: in any case it should only be possible for Jira System Administrators to add or remove user/groups to a certain project as this is regulated elsewhere and it would not be possible to go through an audit if every project lead is able to just add new user to his project.

We are on v9.4.2, and use CROWD for user management.

Thank you for your help.

Dave Mathijs · Accepted Answer

Hi @Karin Biedermann

The Administer projects permission comes with the possibility to add users/groups to Project Roles, there's no further restriction possible.

So the only workaround would be to no grant anyone this permission, but that would mean that the Jira Administrator(s) is/are the only project administrator(s).

Steve Long -Evelon- · Accepted Answer

Hi @Karin Biedermann

So Project Administrators can only add people to Roles within the project, they can't administer user groups, or access Crowd, as I'm sure you're aware.

Unfortunately, there's no way to limit that specific project permission of adding/removing people in the permission scheme.

However, this assumes you have a role-based permission scheme. What you could do is amend the permission scheme to directly include the Crowd groups (not Roles), which in turn would mean that adding people to these roles does nothing and full control is with the Jira System Administators.

Hope that helps - Steve.