Newly created JIRA OnPremise users get default group assignments. Why?

[Ralf Rottmann]

When we manually add new users to our OnPremise JIRA 6.3.9 via Administration > User management > Create, the newly created user is auto-assigned to one additional group, besides the obligatory jira-users group.

As far as we know, we never configured anything like an additional default group. We couldn't find any place in JIRA where we could have configured this.

Long story short: We don't want to auto-assign new users to this additional group. How can we switch this off? Any ideas? Is there any such thing as a list of default groups for newly added users?

[Nic Brough -Adaptavist-]

You've probably added the group to the "can log in" permission. 

Go to Admin -> Global permissions, and look for the line that says "JIRA user" - I expect you'll find both jira-users and your extra group are named in there.

By the way, Jira-users is not obligatory - you can remove it, as long as you use another group to say "can log in".  I also strongly recommend NOT using jira-users (or new groups if you change it) for anything other than "can log in" (and maybe bulk-edit and browse ysers)

[Ralf Rottmann]

Thanks so much, Nic! This was EXACTLY what caused the problem.

One more question, while you're here: Is there an easy way to find out which permissions jira-users grants across the entire system?

[Nic Brough -Adaptavist-]

Ahh, good :-) Unfortunately, no, there's no easy way to get a comprehensive list. There are three places to consider: * The easy one is to look in the global permissions - one page and a handful of options * The nastiest one is the workflows - it's possible to name "jira-users" in transition settings directly. Hopefully, no-one does this ever, but it can't be ruled out. The way I often check this is to export the workflows to xml and physically search it, but even that is horrid * The most complicated one is the project level stuff - first, go through all your permission schemes to see if the group is used directly in them (again, hopefully not, ideally people should stick to roles). That's not so bad itself, but the really awful bit is that you also have to go through all the roles in every project to see if Jira-users is used in any of them (and by default, it is)