JIRA Software project permission - restrict users between projects

[Sebastian Madunic]

I have read most of the articles and guides from the support pages and I thought that I understood how permissions are used but I still can't get it right. 

I have a Jira Cloud instance with 5 projects. So far I have used the default permission schemes, groups etc provided by the Cloud. It works fine BUT as for many others I would like to separate users so that specific users can access only a specific project. 

So I did a simple test. I have a Project, Group and User

This is what I have done:

• Created group "TeamA"
• Added a User to "TeamA"
• Removed the User from "jira-software-users"
• Created a permission scheme "ProjectA_PS".
• Removed all default roles, users and groups from the ProjectA_PS and added only my created group and jira-administrators to the permission scheme.
• Updated Jira Software projectA to use the "ProjectA_PS".

The User is only member in the TeamA group and nothing else. He has Jira software access.

Still when I login as User I can see all other projects and issues we have in our Jira Cloud...I just don't get it??

What have I done wrong? Please don't mention Roles, I have to solve this first before I start using Roles.

[Mikael Sandberg · Accepted solution]

Check your default permission scheme used by the other projects, it is usually set so that logged on users can browse projects and view issues.

[Sebastian Madunic]

Hmm...I think I understand what you write but I still don't get it. My user is only member of TeamA group and nothing else. Can he still browse projects due to a setting in a default user group that he is not member in? In that case the default permission scheme overrides my scheme...interesting. I assume that you refer to all instances of "Anyone logged in" in the default permission scheme. I will check.

[Mikael Sandberg]

If the permission scheme for the projects that your user should not see is set to allow anyone that is logged in to Jira to browse the projects, it does not matter which groups/roles the user have. You need to change all permission schemes if you want to limit project access.

[Sebastian Madunic]

Jippii!!

You are right @Mikael Sandberg, I just had to disable "Anyone logged in" for the default schemes that jira created. After that it worked as expected. Now I have created a permission scheme with roles and assigned this scheme to all my projects and it works just like I wanted.

Thanks for the assistans!!

[Aswin Achuthan]

Can you check if that user was directly added to other project's permission scheme or project roles.

[Sebastian Madunic]

This user was by default added to a group called "jira-software-users". I removed him from that group and he is only member of my "TeamA" group now.

[Aswin Achuthan]

Double check using Project Roles from user management,

"Administration" > "User management" > Search for the user > Open user page > click down arrow next to "Reset password" > "View Project Roles"

[Sebastian Madunic]

The users is listed for one project only ProjectA and has a green dot in the "Developer" column. The two other columns (Administrators and atlassian-addons-project-access) are red.

Developer is a Role I try to use now since the group thing didn't work.