Hide a Project

[Paul Towner]

I would like one of our JIRA accounts to only have access to one of our JIRA projects, so browse/edit access is restricted on all other projects.

What is the best way to do this please?

[Rilwan Ahmed · Accepted solution]

Hi @Paul Towner ,

Welcome to the community !!

On above of what @Nikola Perisic, I would suggest to create groups specific to each project, map groups to project roles and give groups the required Permissions. 
This will help you when you have many users in your system (may be in future),  also this approach benefits if you are using shared permission schemes. 

[Nic Brough -Adaptavist-]

Welcome to the Atlassian Community!

Jira is permissive, not restrictive, in the way it does permissions.  This means you don't let someone into it and then take away their permission to do something.  You grant them the permission to do something.  If you don't want them to do it, you do not give them the permission to do it.

So, what you need to do is remove their permissions from the projects you don't want them to use.

The problem you will see straight away is that the defaults in Jira are highly permissive, with much use of the dynamic role of "any logged in user".  The default permission scheme says "browse project: any logged in user", so everyone in Jira will automatically be able to see any project set to use that permission scheme.

You will need to do a one-off piece of work - go through all your permission schemes and change them so that they only let in the people you want.

The best thing to do is use roles.  For example, where you find "browse project: any logged in user", replace it with "browse project: role:developer, role:administrator"

The use of roles enables you and your teams to look after the members of their project - project admins can add and remove users from the roles in the project as they see fit.

Once you've done this, you will be able to add your limited user to just the projects you want them to see.

Avoid groups, they're a nightmare to maintain, you have to rely on your user admins for every little change, and you have to faff around adding new permission schemes and groups every time you create a new project.  Also, permission schemes do not apply to team-managed projects, they use local roles to do much the same as I described for company-managed projects, so it's more consistent for people using both types of project.

[Paul Towner]

Thanks, this sounds promising, but still quite scary. I did look and Browse Projects seems to have the rule User added, but not "Any logged in User".

Sounds like the first step is create role, call it "restricted developer" and add this new user to it.

Then I update y default schema and where i see "browse project" I remove "User" and ensure all our standard roles are added.

Then when the new user logs in, they should in theory see NO projects or issues.

After this it's then the case of working out how I then set permissions for this "restricted developer" role to browse the particular project.

Is this correct please?

[Nic Brough -Adaptavist-]

Ok, does that "rule User" say it is a role, or a group, or something else?

It may well be that someone has already removed the "any logged in user", and added a role of User to specifically let people in when they are added to the project!

Which means all you need is your restricted developer to be granted browse in that one project (different permission scheme, but hey, only one to create/edit!)

[Paul Towner]

I think it must be a group.

I've created a new permission schema.

Do I need to create a new role, or new group? 

And then in the new permission schema, I take away all the standard permissions for User?

[Nic Brough -Adaptavist-]

It tells you at the top of the list of access members:

In this screenshot, Browse Project is being granted to the project roles called atlassian-addons-project-access and Developers, and later on, the Groups "Community Leaders Access Group" and opsgenie-users

You need a new project role for this, ideally.

[Paul Towner]

From what I can see now it doesn't seem to matter what setting changes I make, when the user logs into our JIRA site, the permissions are forced back.

[Nikola Perisic]

Hello @Paul Towner ,

Welcome to the Atlassian community!

I see that you have the Standard plan tagged in, so I wanna make sure you have the Permissions enabled to you.

To be able to do limit their access is first to edit the existing permission scheme and that an individual user to the "Browse projects" permissions in order for them to see the project.

As for the editing part, what edit permissions they do need: editing issues, comments? Also bear in mind that there are Editing Issues and Editing Own Issues.

Editing issues - User can edit ALL issues (this is not recommended)

Edit own issues - this is something that you are looking for

Let me know.

Br,

Nikola

[Paul Towner]

Thanks for your response. All I really want is for this user to only see one JIRA project, all the projects and issues in those projects must be hidden.

[Nikola Perisic]

As for hiding the issues, you can set up issue security scheme as well.

[Paul Towner]

Thanks, i need the full project hidden