ACP-520: Product admin role requires product access (!!!)

Alex Koxaras -Relational-

Hello all!

So, tomorrow I'm taking the ACP-520 exams and hopefully everything will go ok!

I was reading about the different admin roles and I experiment a bit with them. So the main question I have is if a user with only the product admin role, requires to have product access in order to visit the setting pages and do his thing with workflows etc.  

Based on Atlassian's documentation, no product access is needed:

https://support.atlassian.com/user-management/docs/what-are-the-different-types-of-admin-roles/

Product admin

A product admin can manage administration settings for a specific product. They don’t have access to Atlassian Administration. With the exception of Jira family, product admins can access the content within the product they administer. It’s possible to be a product admin for one or more Atlassian products.

https://support.atlassian.com/user-management/docs/give-users-admin-permissions/

Product admins – They administer settings inside the product depending on group memberships (e.g. Jira products and Confluence settings). Not all product admins need product access (e.g. Product admins for Jira products don’t need product access to Jira or Jira Service Management).

However, I did a little test and I had a user WITHOUT product access, and only with product admin (and site admin, but this I trust is no issue for this question)

 

When I visit my custom login URL I get the following message:

Now, in a way I get it: The user doesn't have product access, so he shouldn't be allowed to login and view the projects etc. But I would expect to either login and navigate me directly to settings or to the main jira screen with view of the projects etc.

If I try to bypass the main screen and view the settings, I get a 404.

Soo... any ideas?

Tomislav Tobijas

Hah, quite interesting...

It seems that if you're on old user management experience you can grant user site permission - Has access on site, together with product administration permission (a.k.a., add that user to a jira-administrators group) and that would be enough. The user would be able to open <site-name>.atlassian.net/jira/ and work navigate to Jira administration from there.

Case 2: If you're on new user management experience, I think there's no site level access or anything similar to that. With what you've described @Alex Koxaras -Relational- and with those same permissions, the user would not be able to navigate to <site-name>.atlassian.net/jira/ nor open Jira administration.
However, if you just grant the user a customer product role for JSM (which isn't a license), then it seems to work the same as in the scenario above; with the old user management experience.

When preparing for an exam, if the exam prep. materials state that it's possible to grant a product admin role without having to do any additional steps, it's most likely referring to the old experience. I'm not sure when the exam questions were last updated but I would follow the same logic if you stumble upon that or similar question.

Anyway, good luck with the exam!