Prevent users from installing Jira apps

[Laurien Scoville]

Is there any way to prevent regular Jira users from being able to install Jira apps? Right now in our instance, regular jira-software-users Users with basic access, and site access have the ability to downright install Jira access. We use SAML.

As a Jira admin, this concerns me.

[Rachit Singhal]

Hi @Laurien Scoville ,

If you are referring to connected apps then below can be the solution of your problem.

Login into your Jira having Org admin permission. Navigate to User Management and go to Products then go to "Connected apps" under Site Settings, there you will find the apps installed by user. You can uninstall the apps that you want by managing each app and to prevent this in future, you can go to settings and "Block user apps" permission.

Please let me know if you sill face any issue.

[Nic Brough -Adaptavist-]

Only administrators can install apps, so I'm a little bit stuck on what you are seeing here.

Non-admins can request app installs, but they can't install them.

[Laurien Scoville]

Unfortunately, that's not the case with us. We are puzzled as well. 

[Nic Brough -Adaptavist-]

Could it be the "site access"?

[Laurien Scoville]

Every active user, despite their other permissions, has that. It's possible, but I think that is necessary for everyone anyway?

[Nic Brough -Adaptavist-]

They only need "application access", I suspect it's your "site access" that makes them administrators so they can (amongst other things) install apps.

[Laurien Scoville]

Site access is what gives them access to the products, though. If I turn that off, they lose access to the products entirely. I feel like I'm darned if I do, darned if I don't, if that's the case...

[Nic Brough -Adaptavist-]

I think we'd need to look at all the groups your users are in, and who you have granted admin rights to.

If you go to Admin -> System -> Global permissions, who are named in the "Jira administrators" permissions?

[Laurien Scoville]

[Nic Brough -Adaptavist-]

That's a standard list, but I'd want to "view users" for the last four lines.

System-admins basically mean "Atlassian", trusted users is something I'm not sure of, but there's a different key for every Cloud site, so it's probably something to do with support. 

I'd expect atlassian-addons-admin to only contain a user for each app you have too, but again, I've not looked for ages.  The last three though, please do check who is in there.

[Laurien Scoville]

I think we may have figured it out. We had to disable user-installed connected apps.