Restrict Jira project admins from adding jira-users group to a project role

[Ravish Nayak]

Jira Project Admins can add any group (main target is jira-users group) to any role in a project.  This causes instance performance issues in combination with notification schemes (sending email notifications to thousands of users in big instances for thousands of notifications) and security disclosure issues with these notifications sent to all Jira users.

Is there a way to block jira-users from project admins? or any workaround solution to hide jira-users groups? Please suggest.

[Alex Koxaras _Relational_]

Hi @Ravish Nayak 

I'm afraid there isn't a way to prevent this. This is an old post (date back to 2013) https://community.atlassian.com/t5/Jira-questions/Restrict-Project-Admins-from-adding-jira-users-group-or-all/qaq-p/357580 but I think that it still applies.

[Ravish Nayak]

Hi Alex,

Thanks for your reply, after going through above link this line made me think about this

"script something that regularly removes jira-users if it's found in any roles"

So please suggest is this approach is still valid? and any other impact?

• Regularly monitor(via cronjob?) the project role to removes/delete jira-users group if it's found in any roles of jira project.
• Which includes REST API calls and useful script (python
• To identify/verify jira-users  existing in particular project `https://<URL>/rest/api/2/project/<project-id>/role/<role-id>
• For Deleting group from project role  -  http://<URL>/rest/api/2/project/'+projecId+'/role/projectRoleID?group=groupToDelete
  
  
  

[Nihar Kumar Dalai]

@Ravish Nayak  Hi Ravish - We have a similar scenario  https://community.atlassian.com/t5/Jira-discussions/Permission-strategy-for-Jira-access-by-external-users/td-p/2371733 . 

Were you able to implement something to send alerts at least if not come up with a restriction ?