First off, I'm extremely new to Jira, so please be kind. The permissions seem a little convoluted coming from other ecosystems so bare with me and my foolish questions. :D Our goals are as follows: * I'd like to setup a couple of PMO people with full permissions to all projects and to create and delete new ones by default. * I'd like Project Managers who only have access to manage projects that they're assigned to by the PMO people. * I'd like Normal Team members who can work on the projects they're assigned to by the PMOs or the PMs. * I'd like Guest users to be able to view projects they're assigned to by the PMO's and the PMs. What is the best way to accomplish this?

nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Permissions

Joe St_ Louis_ous0l3

First off, I'm extremely new to Jira, so please be kind. The permissions seem a little convoluted coming from other ecosystems so bare with me and my foolish questions. Our goals are as follows:

I'd like to setup a couple of PMO people with full permissions to all projects and to create and delete new ones by default.
I'd like Project Managers who only have access to manage projects that they're assigned to by the PMO people.
I'd like Normal Team members who can work on the projects they're assigned to by the PMOs or the PMs.
I'd like Guest users to be able to view projects they're assigned to by the PMO's and the PMs.

What is the best way to accomplish this?

Accepted answers

Robert DaSilva_a432as

Hey @Joe St_ Louis , welcome to the community!

Jira permissions can get a bit confusing, let me try and break this down. The short answer to your question, however, is this should be possible without too much heartache.

Firstly, I want to make sure I explain the different types of Jira projects. Fundamentally, you can have either "Company Managed" or "Team Managed". Generally, best practice is to go with Company Managed as this allows the administrators to impose standardized processes among teams. Team Managed projects are nice as they let individual teams configure them to their hearts content, but this can become a bit messy if you need to move data around at any time in the future.

Jira permissions operate on a few different levels. At the top level, you have Product Administrator permissions or privileges. This level gives users, among other things, the ability to create "Company Managed" projects.

The next level down would be Project Permissions, where you can control specifics about individual (or many) Jira Projects.

Finally, below that is Issue specific permissions, where certain issues can be restricted.

For your use case, it sounds like you'll need your PMO folks to be considered "Jira Administrators" if you want them creating projects on the fly. This is not something I would normally recommend, as it's really easy to have the overall configuration of the instance spiral out of control pretty quickly. I would recommend keeping the number of Jira Administrators on a short list, and try and enforce limited changes to avoid a huge number of configuration items.

Once you have your projects set up, we'll want to configure a Permission Scheme for the project. Permission schemes can be applied to one or more Company Managed projects, to ensure they all share similar permission structures. You can assign individual people permissions inside the scheme, but I would recommend creating something called a "Project Role", and assigning that specific permissions instead.

So, what would that look like.

You'll want the following Project Roles:

Project Manager
Team Member

Well, the ability to even see if a project exists is controlled by the "Browse Project" permission. You'll likely want _everyone_ to have this permission, so they can see work items in Jira.

You can then assign the "Project Manager" project role to the "Administer Project" permission, so they can manage the Jira projects themselves.

There are a variety of permissions you'll want to give the "Team Member" project role, but most importantly would be "Edit Issue" and others in this range.

Once you have the permission scheme set up, you can assign it as the default, or ensure it's assigned to new projects.

Finally, within each project, you'll want to invite the users and grant them the specific Project Roles assigned to their specific duties.

I would recommend giving a read through the existing Project Permission Schemes, and doing some review of what the individual permission accomplish.

You can also look through some of the documentation Atlassian has, which is pretty good:

Phew, that was a lot. Hopefully that helps you! Happy to discuss further if you need more assistance.

All comments

Mikael Sandberg

Hi @Joe St_ Louis,

Welcome to Atlassian Community!

In order for your PMOs to be able to create a delete company-managed projects you have to make them Jira admins. If you are only using team-managed projects you can set the global permission that allows you to create tmps to the PMO group.

And for the other users, it all depends on what type of project you are using. In company-managed projects your PMOs can assign the project lead and then the project lead can add/remove users based on roles. You would also need a new permission scheme since the default one gives everyone access to projects.

If you are using team-managed projects you can set the access to private and then it is up to the project admin whou get access to the project. Check out this KB for more information.