How can I grant access to view all alerts but only modify those from the user's team?

[Guilherme Nicolosi]

I created a role for users with expanded access. I want them to be able to see alerts from all teams and have edit only admin rights but I don't want them to be able to modify other teams alerts. Is that possible?

[Shivam Naik · Accepted solution]

Hi @Guilherme Nicolosi ,

Happy to help!

You can grant those custom roles "read only" Admin right, and that will still allow you to select "See All Alert" in the permissions:

Please let me know if that helps!

[Guilherme Nicolosi]

Yes, I am able to grant access to seeing all alerts. The problem is that with that, comes the ability of acking and closing all alerts. I want them to be able to have "read only" access to all alerts except those of the user's teams. Let's say I have a user that part of the Network team - I want him to be able to manage alerts assigned to that team and see alerts assigned to the Infrastructure team, but not manage them. 

That way we can provide visibility (let users know of other issues potentially affecting shared infrastructure) and have better governance of the alerts by not allowing users to manage alerts outside of their team

[Guilherme Nicolosi]

@Shivam Naik , it seems that the restriction is that the alert action permissions seem to be applied to all visible alerts, according to the documentation:
https://support.atlassian.com/opsgenie/docs/learn-user-roles-and-permissions/

I couldn't find a way to restrict edit rights to alerts assigned to the user's team.

[Shivam Naik]

Hi @Guilherme Nicolosi 

Thank you for the clarification, that is correct, when you select "See All Alerts", that refers to site-wide, there isn't a way to restrict that to Team-only alerts. You could grant that user the role of "Team Admin" on their respective team to allow them to see all of that Team's alerts and action on them as needed. But there isn't a way to create a site-wide custom role allowing them to see all alerts site-wide with a restriction on action to just their teams. The Admin Custom Role is an Admin for the entire site, so action would be allowed via that. If the focus is on allowing them to see all alerts for their own team and only be able to action on those, then using the "Team Admin" role in the members section of their Team might be the best way to go.

I would also recommend opening a Support ticket with us so that we can create a Feature Request for this and tie it to your account for future updates since the functionality you're looking for in Custom Roles isn't currently possible.

Please let me know if you have any follow up questions