ACP-520: Product admin role requires product access (!!!)

[Alex Koxaras _Relational_]

Hello all!

So, tomorrow I'm taking the ACP-520 exams and hopefully everything will go ok!

I was reading about the different admin roles and I experiment a bit with them. So the main question I have is if a user with only the product admin role, requires to have product access in order to visit the setting pages and do his thing with workflows etc.  

Based on Atlassian's documentation, no product access is needed:

https://support.atlassian.com/user-management/docs/what-are-the-different-types-of-admin-roles/

Product admin

A product admin can manage administration settings for a specific product. They don’t have access to Atlassian Administration. With the exception of Jira family, product admins can access the content within the product they administer. It’s possible to be a product admin for one or more Atlassian products.

https://support.atlassian.com/user-management/docs/give-users-admin-permissions/

Product admins – They administer settings inside the product depending on group memberships (e.g. Jira products and Confluence settings). Not all product admins need product access (e.g. Product admins for Jira products don’t need product access to Jira or Jira Service Management).

However, I did a little test and I had a user WITHOUT product access, and only with product admin (and site admin, but this I trust is no issue for this question)

When I visit my custom login URL I get the following message:

Now, in a way I get it: The user doesn't have product access, so he shouldn't be allowed to login and view the projects etc. But I would expect to either login and navigate me directly to settings or to the main jira screen with view of the projects etc.

If I try to bypass the main screen and view the settings, I get a 404.

Soo... any ideas?

[Alex Koxaras _Relational_]

EDIT:

So the problem is the following:

If you don't accept the invitation sent from the instance, and you go directly from the app switcher and/or manually type the instance URL, then you get introduced to the "You shall not pass" message.

It seems that the proper way is to accept the invitation and then try to login. That will solve the problem and indeed the product admin can login without having product access. :/

HOWEVER:

If you log out from your account and try to login again, you will not have access to the instance again! Am I missing something?

So my product admin user, which now has user access admin and is a site admin, is like that:

He is able to view the admin section via admin.atlassian.com and as a site admin he can navigate to the following screen, where he clicks to visit the jira instance:

Now, I would expect that Jira will let him visit the instance, see only the project settings of the projects and actually do his jira admin magic. However, this is not the case and I'm presented again with the "you shall not pass" popup:

[Alex Koxaras _Relational_]

If you grant this user another product access, e.g. Confluence, he will be able to login to /wiki. From there, he can manually navigate to jira by using /jira, replacing the /wiki suffix.

Navigating on his switcher though, Jira is not visible as an option:

[Tomislav Tobijas _Koios_]

Hah, quite interesting...

It seems that if you're on old user management experience you can grant user site permission - Has access on site, together with product administration permission (a.k.a., add that user to a jira-administrators group) and that would be enough. The user would be able to open <site-name>.atlassian.net/jira/ and work navigate to Jira administration from there.

Case 2: If you're on new user management experience, I think there's no site level access or anything similar to that. With what you've described @Alex Koxaras _Relational_ and with those same permissions, the user would not be able to navigate to <site-name>.atlassian.net/jira/ nor open Jira administration.
However, if you just grant the user a customer product role for JSM (which isn't a license), then it seems to work the same as in the scenario above; with the old user management experience.

When preparing for an exam, if the exam prep. materials state that it's possible to grant a product admin role without having to do any additional steps, it's most likely referring to the old experience. I'm not sure when the exam questions were last updated but I would follow the same logic if you stumble upon that or similar question.

Anyway, good luck with the exam!

[Alex Koxaras _Relational_]

Thank you @Tomislav Tobijas _Koios_ for your reply. But I've found the problem :) 

[Alex Koxaras _Relational_]

Nope, haven't found the solution yet, since the problem still remains.. Ill update above