Define company-managed space permissions with schemes
20 min
By the end of this lesson, you’ll be able to:
- Describe permission schemes
- Create a permission scheme
- Configure company-managed space permissions in a permission scheme
- Configure a permission scheme using roles
What are permission schemes?
For company-managed spaces, you’ll use permission schemes. A permission scheme grants space permissions, like Browse Spaces, to users, groups, and space roles. Only Jira admins can create permission schemes and associate them with company-managed spaces.
Team-managed spaces don't use permission schemes. Team-managed space admins have more control over their space permissions as they don’t rely on Jira admins for configuration. However, their space permissions are less flexible.
Permission schemes prevent Jira admins from having to configure permissions individually for every space. Some Jira sites have hundreds of spaces, so this saves a lot of administrative work. Jira admins can associate a permission scheme with one space or share it across many spaces. This also helps users as their interactions with spaces will be consistent.
👉 For example: Nell is a Jira admin. After talking to her team leads and Jira users, she realizes that business teams, like Marketing and Legal, have different space configuration needs than software development teams. She configures two permission schemes to meet their requirements. The Default permission scheme applies to any new company-managed business space. The Default software permission scheme applies to any new company-managed software space.
To access the permission schemes in your site:
- In the upper-right corner of Jira, select the Settings icon (represented by a gear).
- Under Jira admin settings, select Work items.
- From the sidebar, under Work item attributes, select Permission schemes. This is the Permission schemes admin page.
Configure a permission scheme
Create a permission scheme
You’ll first need to create a permission scheme before you can configure it.
To create a permission scheme:
- On the Permission schemes admin page, select Add permission scheme.
- Enter a name and description that accurately and clearly describe the purpose of that permission scheme. This will help you and other Jira admins associate the appropriate schemes to spaces.
- Select Add.
After you create it, the permission scheme includes a list of all permissions, but no users, groups, or roles.
If you already have a permission scheme that’s similar to what you want to configure, you can copy and modify it. On the Permission schemes admin page, next to the scheme you want to copy, select Copy.
Grant permissions to users, groups, and roles
Next, you’ll grant the permissions in the scheme to a variety of users, groups, and roles.
There are two ways to grant a permission in a scheme:
- On the permission scheme's admin page, next to any permission, select Update. Select who you want to grant access to, then select Update.
- On the permission scheme's admin page, in the upper-right, select Grant permission. Search for and select the permission you want to update, then select who you want to grant access. If you want to grant additional permissions, select the Grant another permission checkbox. Select Grant.
👇 Click the boxes below to learn more about who you can grant permissions.
Let’s explore some examples of how you’d configure a permission scheme.
👉 First example: The Default software permission scheme is very open, with many permissions granted to any logged in user. However, some software spaces need to have more restrictive permissions for security reasons. You create a more restrictive permission scheme where only members of the Developers group can browse spaces, create work, and add comments to work in associated spaces.
👉 Another example: You create a Development permission scheme where any logged in user can browse spaces and edit work. However, only users with the Administrator space role or the Scrum Lead space role can manage sprints.
When you grant a permission to multiple entities, like two space roles, users have to be in either role, not both.
👇Watch the video below to see how to configure a permission scheme.
Associate a permission scheme with a space
To apply the permissions in a permission scheme, you need to associate it with one or multiple spaces. Only Jira admins can associate permission schemes with spaces. If a space’s permission scheme grants permissions to roles, though, the space admin can assign users and groups to that role. Other than that, the space admin can’t configure permissions.
When you first create a company-managed space, it will use the default permission scheme associated with that space type.
👉 For example: All new company-managed software spaces will use the Default software scheme.
You can change the scheme a space uses after you create it.
To associate a permission scheme with a space:
- Open the space in Jira.
- In the sidebar, next to the space name, select More actions (represented by ···), then Space settings.
- In the space settings sidebar, select Permissions.
- In the upper-right, select Actions, then select Use a different scheme.
- Select your scheme, then select Associate.
👇Watch the video below to see how to associate a permission scheme with a space.
Troubleshoot permission schemes
Many parts of Jira interact with permissions, so there are some implications to remember:
- Workflows impact permissions. You can configure conditions and properties for workflows that prevent users from transitioning or editing work, even if their space’s permission scheme enables them to.
- Product access impacts permissions. Users need access to a product in order to do anything they have permission to do. They can’t browse spaces in Jira Service Management if they don’t have access to the product.
Let’s explore an example!
Ayo is a Jira admin. She meets with a group of software space admins who have special requirements. Certain team members need to be able to delete work. Normally, only admins can delete work items. But, we don’t want to give full admin permissions to these team members.
☝️How can Ayo meet this requirement?
Ayo, the Jira admin, will:
- Create a custom space role called “Work managers.”
- Create a new permission scheme called “Alternative software permission scheme” and note the Delete Work Items permission in the scheme description.
- Assign the Delete Work Items permission to the Work managers role.
- Associate the Alternative software permission scheme with the necessary spaces.
The space admins will add the necessary users to the Work managers custom role for their spaces.
If this requirement applied to all Jira spaces, Ayo could just modify Jira’s default software permission scheme. However, since only a small group of spaces have this requirement, Ayo should create a new scheme.