How to isolate users to a specific project?

[Chris]

Hi All, I'm the Jira admin for Dept A and Dept B. Each department has its own associated Project. I want users from Dept B to only be able to create issues under Project B. Currently they can ignore the drop-down and create one under Project A, which creates billing issues between the departments. I Googled first and found this: https://confluence.atlassian.com/cloud/manage-groups-744721627.html but I don't have "User Management" under the gear icon; all I have is "Projects".

EDIT: I've requested JIRA admin access, if I don't get it I'll pass them the ticket, lol

[Nic Brough -Adaptavist- · Accepted solution]

"I don't have "User Management" under the gear icon;"

That means you are a project administrator, not a JIRA administrator.  Your powers over users are limited to being able to add and remove them from roles in the projects you have admin for.

Have a look at the permission scheme for project B, that should tell you the rule for "who can create issues".  Hopefully, it will say something simple like "role: users", and then you'll be able to remove the people from that role in the project.  But you might need to get the scheme amended - for that, talk to your JIRA admins.

[Chris]

Ok so I've got Admin access now. Can I create a group and Dept. B to that group and block the group's access to Project A, or do I have to put my Dept. A users into a group and limit Project A access to Dept. A?

[Joe Pitt]

You don't BLOCK access. You grant access. Thinking about blocking will confuse you and cause problems. Think Grant

[Chris]

Ok so limit access to the people I want to have it rather than block it from those who don't.

[Joe Pitt]

Yes. There is no blocking in permission schemes in JIRA The standard security model is to ALLOW people access. By default they have no access. Allowing all and trying to block leaves HUGE security holes.

[Yugank Bhatnagar]

Hi Chris

I would suggest either you rquest you work with Admin of JIRA or request for Admin rights whichever you feel would be easy to access.

Then you can create two groups say Group A for Dept A and Group B for Dept B. Then assign users to the respective groups. 

Then,

Navigate to usermanagement->Projects (Project A or B)->Permissions
Under Project permissions->Select Edit Permission
Now for Create Issues assign the access to group of Group A for Project A which will exclusively give Ability to create issues.

Remove any unwanted usergroups users if listed. Hope it helps.

Thanks

Please accept the answer if it works !

[Joe Pitt]

The problems with groups is only jira admins can manage them, whereas project admins can administer project roles. Having project admins also jira admins can cause problems if they do something that impacts other projects, which they would be able to do as jira-admins. I've been involved in systems where people just tried something to see what would happen because they can. And it becomes a mess.

[Nic Brough -Adaptavist-]

Please, do not do this.  I am sorry Yugank, but some of this is a bad answer.

Use roles.  Always use roles.  There are a few minor cases for using groups in permission schemes, but for almost all of the time, using a group is the wrong thing to do.

And on Joe's point about administrators - your admins should be a small group of knowledgable people who work together closely.  Project leads having admin rights has kept me in "clean up the mess we've made" work for over a decade...

[Chris]

Yeah I'm internal IT, I wouldn't want anyone from the users to have powers over this stuff. Like I said in the OP, I just need to force Dept B to only be able to create tickets in Project B so they can be billed correctly as they pay Dept A for the IT services I provide. Gotta love it.

[Joe Pitt]

Like Nic said, you may need to get the JIRA admins involved. Often this problem is caused by putting the jira-user or other large group in the permission scheme or a role. Jira-user is the group everyone, by default, belongs that can logon to JIRA.  If you keep in mind access is by PERMISSION, not restriction it will help you understand who can access your project. There is no option to restrict in the permission scheme.

[Yugank Bhatnagar]

Thanks Nic for the suggestion.