nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Need way to restrict “Change access” so only org admins can use it (team‑managed & JSM)

Vallala Ujwala_71sy54

I’m trying to enforce a strict access control model in my Jira Cloud site

Only Org Admins (group: org-admins) should be able to change project/space access and permissions.
Other project admins (including test admins / team leads) must not be able to change access.

Accepted answers

Arkadiusz Wroblewski

Hello @Vallala Ujwala

in Jira Cloud you can’t really do “project admin, but not allowed to change access”.

In team-managed (and JSM team-managed service projects), the Administrator role is basically “you can configure the project”, and that includes Change access. There’s no separate switch to lock that down only to org admins while still letting team leads be project admins.

So your real options are:

Governance option: only put your org-admins in the team-managed Administrator role. Everyone else gets lower roles.

Strict control option: use company-managed projects for anything that needs centralized permission control.

And as a preventive measure: limit who can create team-managed projects, otherwise new “locally controlled” projects will keep popping up.

Short version: team-managed is designed for local autonomy. If you need “only org admins can change access”, you either remove admin from others or go company-managed for governed projects.

All comments

Arkadiusz Wroblewski

Hello @Vallala Ujwala

in Jira Cloud you can’t really do “project admin, but not allowed to change access”.

So your real options are:

Governance option: only put your org-admins in the team-managed Administrator role. Everyone else gets lower roles.

Strict control option: use company-managed projects for anything that needs centralized permission control.

And as a preventive measure: limit who can create team-managed projects, otherwise new “locally controlled” projects will keep popping up.

Short version: team-managed is designed for local autonomy. If you need “only org admins can change access”, you either remove admin from others or go company-managed for governed projects.

Joseph Chung Yin

@Vallala Ujwala -

I believe you need to ensure each project's "Administrator" role is only assigned to org admin (JSM project) + Project's Permission Scheme - Administer projects right is only granted to org admin.

For Team Managed project type project, by enforcing the what you wanted, it defeats the purpose of having Team Managed projects to be utilized in your site.

By default - project's Administrators role members manages the space access and permissions given to the his/her project users.

Hope this helps.

Best, Joseph Chung Yin

Marc -Devoteam-

Hi @Vallala Ujwala

@Joseph Chung Yin and @Arkadiusz Wroblewski are both right here.

But if you are on a Free subscription of Atlassian, there are nog permission configurations possible, as this can only be achieved on paid subscriptions.

Arkadiusz Wroblewski

Thats true.

Vallala Ujwala_71sy54

Is it possible to restrict other admins and allow only org admin to change the channel access for JSM company managed projects Screenshot 2026-03-01 155651.png

Vallala Ujwala_71sy54

please help me here

Arkadiusz Wroblewski

Hello and good Sunday @Vallala Ujwala

Yep but sadly not in the way you want.

In JSM company-managed, Channel access is part of project configuration. So if someone is a Project Admin on that project, they can change it. Cloud doesn’t give you a separate permission like “can admin the project, but can’t touch channel/customer access”.

So the only way to enforce “only org admins can change this” is governance:

keep Project Admin limited to your platform/org-admin group

don’t give Administer projects to team leads/test admins

and remember: anyone with global Jira Admin can override anyway

So the lever isn’t a setting, it’s who you allow to be Project Admin.

It’s less elegant than we’d like, but that’s how the permission model is designed today.

Vallala Ujwala_71sy54

@Arkadiusz Wroblewski Is it possible to make a field read-only using a script?
For example, in DC, we can write a fragment based on user groups and make a class or ID read-only. Is something similar possible in cloud If so, could you please suggest how it can be implemented?

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira-service-desk-cloud

jira-service-management-cloud

jira-service-management