project role permission can't restrict user creat issue even who doesn't belong this project

[ericli]

For example:

user belong jira-user  and belong project vmse-ticketTrack R&D(custom a user list) and then the relationship as blow image , my original will was let him only creat issue in vmse-tickeTrack, but him can creat issue in another project .

1.png

I guess the reason is the user belong the default jira-user group, but I can't remove him from jira-user ,otherwise he even can't login be allowed.

   how do I configure can fix the problem?

[Nic Brough -Adaptavist-]

You need to stop using the jira-users group to allow access to projects (except where a project genuinely is "access for everyone")

First, check the permission scheme lets you do what you want - e.g. "everyone in the role of R&D can read the project" and "Everyone in the role of tester can be assigned issues", and so-on

Then remove the jira-users group from the roles.  Replace it with other groups that accurately reflect what your users actually need, and/or put the users in the roles individually.

One general piece of advice - despite the defaults in a new off-the-shelf JIRA being set up this way, using the group jira-users for anything is a pain, and you should NOT do it.  Use Jira-users to say "can log in", and nothing else (other than genuinely global stuff - the "support this jira" project, "browse users", and "bulk edit" maybe).