Granting user management rights to project admins

[Andreas Liskes]

Dear community,

Following scenario: Have JIRA and confluence hosted in cloud. Having 500+ users which have been assigned to groups to manage access and permissions for JIRA projects and confluence spaces.

Want to delegate the task of user permission assignment / group membership management to project managers without assigning project managers to global admin group. 

Users should be assigned to groups instead of managing permissions for JIRA and confluence separately. 

Any ideas?

Kind Regards,

Andreas

[Rob Woodgate]

Hi Andreas,

There are application admins (e.g. Confluence admin, JIRA admin) and site admins.  Only site admins have access to the user management tools.  There are several reasons for making user management a restricted function:

1. Adding users can push you into a new licence tier and cost you a lot of money;
2. Within user management you can login as another user, which allows you to see restricted pages that the user can see but ordinarily you can't;
3. User management also includes billing, password policy and single sign-on, all of which should not be delegated to non-admin users.

You say that "logically there should be the possibility to delegate the permission", but (as a site admin) I'd be very concerned if staff without any infosec training or understanding of our internal user management policies had access to that functionality.  Besides anything else, being able to login as another user and view restricted material could be, depending on where you live, not just unethical but also illegal. 

In this instance Atlassian have - rightly - prioritised security.  I can promise you that the overhead of cleaning up after an untrained admin is far greater than the overhead of the PMs having to make a change in both applications, especially if the country where you're operating has strict data protection laws.

[miikhy]

Hi,

If you need to empower users and delegate group management to a set of selected users in Jira, I've recently published a plugin which might help! It's a brand new plugin so I'm really interested in feedback to give orientations to my roadmap!

You can try it out here, I'll be more than happy to improve it to suit more needs: https://marketplace.atlassian.com/plugins/com.caritteprod.group-ambassadors/server/overview

Cheers

[Nic Brough -Adaptavist-]

To maintain user groups, you have to be an admin.

The best solution is to delegate it.  In Confluence, make your PMs space admins, then they can add the users (and groups if you insist on using them) to the permissions they need.  In JIRA, use roles in permissions, notifications and workflows, then the PMs can add the users (and groups) to the roles.

[Andreas Liskes]

Thx for reply.

That's the standard approach for managing permissions.

PMs then need to manage permissions twice, 1st in confluence, 2nd in JIRA. 

Was looking for an option to avoid this additional overhead.

When creating a new space or project is's easy to add an access group for those. Logically there should be the possibility to delegate the permission to PMs to manage the member of this group without making them site-admins.

Haven't found this possibility, so I fear PMs have to assign users to confluence and JIRA separately. 

/Andreas

[Nic Brough -Adaptavist-]

They're separate systems, so yes.  There's often a need to do these things separately.