Permission to manage users of a certain group

[Zoltán Lehóczky]

Under the global User management page (i.e. https://company.atlassian.net/admin/users) I'd like certain non-admin users (specifically: project leaders) to be able to add users to/remove users from specific user groups (in this case, their project's user group) but without being a global administrator.

Note: not having a better option I selected JIRA as the affected service, but this is really part of the global Atlassian user management feature, affecting not just JIRA but also Confluence.

Thanks in advance.

[Nic Brough -Adaptavist- · Accepted solution]

Can't do it (yet).  You're either an admin with access to users and everything else or you're not an admin.

You can do it if you have external management of users (e.g. LDAP or Crowd) because you can use those systems to control it.  But that's not an option on Cloud.

However...

Atlassian are not going to do anything about delegating group management, but they have already fixed

>(specifically: project leaders) to be able to add users to/remove users from specific user groups

Stop using groups and use roles.  Project admins can put any user (or group) into a role in their project.  They don't need global admin to do this, it has no effect on groups and it's really simple.  Forget groups and show your project admins how to add people into roles.

A similar principle applies to Confluence, although that does not have roles - get the space admin to add/remove/update users (or groups) in space admin -> permissions.

[Zoltán Lehóczky]

Thank you for elaborating this. I've opened a feature request about this, maybe Atlassian will take care: https://jira.atlassian.com/browse/CLOUD-8451 We have a very prudent group management set up and we certainly don't want individual users to be added to anything. Since groups is the link between JIRA and Confluence user management we need to use this to have a single point when a new users needs to be added to a new project (which corresponds to, among others, a project in JIRA and space in Confluence). Using roles instead would be certainly an option but that would mean that now users need to be added to (e.g.) the developer role in JIRA and as a user with individual permissions to Confluence. This is far from the user management we want to apply.

[Nic Brough -Adaptavist-]

It's always worth asking them to improve stuff. :-)

[Ignacio Pulgar]

I think project administrators cannot add groups to roles, but just users on a one per one basis.

[Nic Brough -Adaptavist-]

They can add groups to roles as well as users.

[Mike Shkolnik]

RE: "Stop using groups and use roles." What's wrong with using both? I'd like to add a group of dashboard viewers to a roll that only has read-only access to my project. Adding each user to that role individually can be done, but cannot be easily re-used on multiple projects without putting them in a group - without a group each project would have to individually add the same list of 20+ viewers, and those multiple lists would get out of sync. Also, the list of people on the project gets long and messy. Better to manage such viewers as one group. 

[Nic Brough -Adaptavist-]

Have another read of the answer.  It's not about not using groups, it's about wasting your time using groups for permissions.

A shorter way to put it though:  Stop using groups (in permissions) and use roles.

[miikhy]

Hi,
If you need to empower users and delegate group management to a set of selected users, I've recently published a plugin which might help! It's a brand new plugin so I'm really interested in feedback to give orientations to my roadmap!
You can try it out here, I'll be more than happy to improve it to suit more needs: https://marketplace.atlassian.com/plugins/com.caritteprod.group-ambassadors/server/overview
Cheers