How to restrict user's access to only one project?

Question

Hi,

I added two new users, but did not give them access to any projects. However, they are able to get full administrative view of my business projects... which I don't want them to see.

Can anyone tell me how to prevent this?

Thanks

Joe Pitt · Answer

There really isn't a fix. It clearly states how permissions are given and the jira-users group allows people to logon. It often comes up after they've been using JIRA for awhile and decide they don't want everyone to see a new project. The standard best practice security model is only allow access when needed, not give universal access and then restrict. However, this is how too many JIRA admins think.

Adrian Mussanna · Answer

Thanks, I only see this on Business Boards. If this is a common error, then I suggest that Atlassian amends this asap.

Thank you both for your responses.

Joe Pitt · Answer

The most common error is adding the jira-users group to the permission scheme.  JIRA works on a Permit, not Restrict model. You GIVE permissions. You can't deny access. I suggest project roles. It allows the project admin to manage access.