Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Next challenges

Recent achievements

  • Global
  • Personal

Recognition

  • Give kudos
  • Received
  • Given

Leaderboard

  • Global

Trophy case

Kudos (beta program)

Kudos logo

You've been invited into the Kudos (beta program) private group. Chat with others in the program, or give feedback to Atlassian.

View group

It's not the same without you

Join the community to find out what other Atlassian users are discussing, debating and creating.

Atlassian Community Hero Image Collage

How to restrict the visibility of the Jira-projects

Hi All,

Is there a guideline how to restrict the visibility of the Jira projects?

In the last time I got a lot of request, that not only firm internal Jira users, also worldwide Jira users have acces to sensible datas?

Do you know sth about this problem/ issue??

Kind regards and nice weekend,

Sibel

2 answers

0 votes
Joe Pitt Community Leader Jan 24, 2020

JIRA GRANTS permission, it doesn't restrict. 

First, by default JIRA has a horrible permission scheme that violates security best practices by allowing everyone that can logon to do just about everything.

JIRA works by GRANTING access. You can't restrict access. By default, it grants access to the group used to logon (see Global permissions to see the "can use" groups and admin groups).  This is where users are getting their access.

  1. The FIRST thing you need to do to get control is to remove any groups with logon privileges from the permission scheme unless you absolutely want everyone to have that permission.
  2. Then I suggest you setup Project Roles for the various functions like, tester, QA, Browse Only, etc.
  3. By using project roles, one permission scheme will cover all projects. The project admin controls project role membership
  4. If the project leads want everyone that can logon access to the project they can add the logon group to a project role with the desired permissions.

This may be a big effort, but it will pay off down the road by making it easy to control access.

Most of the 'old timers' use project roles. It meets the best practice for security and gives complete control to the project lead for access to their project. JIRA comes with many project roles, but you can add more if you have a special need.

If you want people that aren't users (the public) you need to allow the browse permission to ANYONE. You can do that on a project by project basis. However once someone has access you can only restrict access to individual issues with a issue security scheme. The common use for that is only the reporter and a project role can see the issue. 

0 votes
Adrian Atlassian Team Jan 24, 2020

Hi @Sibel Yasar 

The following articles will help you understand better as well :

Project-level permissions: https://confluence.atlassian.com/adminjiracloud/managing-project-permissions-776636362.html

Issue-level permissions (Issue security levels) : https://confluence.atlassian.com/adminjiracloud/configuring-issue-level-security-776636711.html

Suggest an answer

Log in or Sign up to answer
TAGS

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you