Documentation for JIRA 6.3 EAP developer (EAP) releases only. Not using this? See below:
(JIRA 6.2.x documentation | JIRA OnDemand documentation | earlier versions of JIRA)

Skip to end of metadata
Go to start of metadata

Global permissions are system wide and are granted to groups of users.

Icon

See also project permissions, which apply to individual projects.

On this page:

This table lists the different global permissions and the functions they secure:

Global Permission

Explanation

JIRA System Administrators

Permission to perform all JIRA administration functions.
(warning) The number of users that count towards your JIRA license is the sum of all users (including users in groups) that have the JIRA System Administrators permission, even if they do not also have the JIRA Administrators or JIRA Users permissions. A user with JIRA System Administrators will be able to log in to JIRA without the JIRA Users permission, but may not be able to perform all regular user functions (e.g. edit their profile) unless they also belong to a group that has the JIRA Users permission.

JIRA Administrators

Permission to perform most JIRA administration functions (see list of exclusions below).
(warning) The number of users that count towards your JIRA license is the sum of all users (including users in groups) that have the JIRA Administrators permission, even if they do not also have the JIRA System Administrators or JIRA Users permissions. A user with JIRA Administrators will be able to log in to JIRA without the JIRA Users permission, but may not be able to perform all regular user functions (e.g. edit their profile) unless they also belong to a group that has the JIRA Users permission.

JIRA Users

Permission to log in to JIRA.
(warning)  The number of users that count towards your JIRA license is the sum of all users (including users in groups) that have this permission. If you want to reduce this count, see Updating your JIRA License Details.
(info) Granting the JIRA Users permission to a group results in all newly created users being automatically added to that group. The exception to this are groups that also have either the JIRA System Administrators or JIRA Administrators permissions, since JIRA prevents groups with these administrative-level global permissions from being granted the JIRA Users permission. Furthermore, it would be unwise to automatically grant these administrative-level global permissions to all new users.

Browse Users

Permission to view a list of all JIRA user names and group names. Used for selecting users/groups in popup screens. Enables auto-completion of user names in most 'User Picker' menus and popups.

Note that the Assign User permissions also allows a limited version of this on a per-project basis.

Create Shared Objects

Manage Group Filter Subscriptions

Permission to manage (create and delete) group filter subscriptions.

Bulk Change

Permission to execute the bulk operations within JIRA:
- Bulk Edit *
- Bulk Move *
- Bulk Workflow Transition
- Bulk Delete *
( * subject to project-specific permissions.)

(warning) The decision to grant the Bulk Change permission should be considered carefully. This permission grants users the ability to modify a collection of issues at once. For example, in JIRA installations configured to run in Public mode (i.e. anybody can sign up and create issues), a user with the Bulk Change global permission and the Add Comments project permission could comment on all accessible issues. Undoing such modifications may not be possible through the JIRA application interface and may require changes made directly against the database (which is not recommended).

Granting global permissions

  1. Log in as a user with the JIRA Administrators global permission (or the JIRA System Administrators global permission, if you need to grant the JIRA System Administrators global permission).
    (info) By default, the user account created during the JIRA Setup Wizard has both of these global permissions.
  2. Choose > System. Select Global Permissions to open the Global Permissions page, which lists JIRA's global permissions.
    (tick) Keyboard shortcut: g + g + start typing global permissions

    The Add Permission box is shown at the bottom of the list (not displayed in the screen capture above).
  3. In the Permission dropdown list, select the global permission you wish to grant.
  4. In the Group  dropdown list, either:
    • select the group to which you wish to grant the permission; or
    • if you wish to grant the permission to non logged-in users, select Anyone. This is not recommended for production systems, or systems that can be accessed from the public Internet such as OnDemand,
      (info) Please Note:
      • The JIRA Users permission (i.e. permission to log in) cannot be granted to Anyone (i.e. to non logged-in users) since this would be contradictory.

      • The JIRA Users permission cannot be granted to groups that have the JIRA System Administrators or JIRA Administrators permissions.

      • If you have a user limited license (e.g. personal license) and have reached your user limit, you will not be able to grant the JIRA Users permission (i.e. permission to log in) to any further groups without first reducing the number of users with the JIRA Users permission.

Removing global permissions

  1. Log in as a user with the JIRA Administrators global permission (or the JIRA System Administrators global permission, if you need to remove the JIRA System Administrators global permission).
    (info) By default, the user account created during the JIRA Setup Wizard has both of these global permissions.
  2. Choose > System. Select Global Permissions to open the Global Permissions page, which lists JIRA's global permissions.
    (tick) Keyboard shortcut: g + g + start typing global permissions
    (info) For each global permission in JIRA (indicated on the left of this page), groups which currently have that permission are shown on the right (under the Users / Groups column).
  3. Locate the global permission you want to remove from a group as well as the group you want to remove that permission from (under Users / Groups) and click the Delete link next to that group.

About 'JIRA System Administrators' and 'JIRA Administrators'

People who have the JIRA System Administrators permission can perform all of the administration functions in JIRA, while people who have only the JIRA Administrators permission cannot perform functions which could affect the application environment or network. This separation is useful for organisations which need to delegate some administrative privileges (e.g. creating users, creating projects) to particular people, without granting them complete rights to administer the JIRA system.

People who have the JIRA Administrators permission (and not the JIRA System Administrators permission) cannot do the following:

It is recommended that people who have the JIRA Administrators permission (and not the JIRA System Administrators permission) are not given direct access to the JIRA filesystem or database.

Separating 'JIRA System Administrators' from 'JIRA Administrators' in default JIRA installations

By default, the jira-administrators group has both the JIRA Administrators permission and the JIRA System Administrators permission. Also by default, the user account created during the JIRA Setup Wizard is a member of this jira-administrators group.

If you need some people to have only the JIRA Administrators permission (and not the JIRA System Administrators permission), you will need to use two separate groups, e.g.:

  1. Create a new group (e.g. called jira-system-administrators).
  2. Add to the jira-system-administrators group everyone who needs to have the JIRA System Administrators permission.
  3. Grant the JIRA System Administrators permission to the jira-system-administrators group.
  4. Remove the JIRA System Administrators permission from the jira-administrators group.
  5. (Optional, but recommended for ease of maintenance) Remove from the jira-administrators group everyone who is a member of the jira-system-administrators group.

Troubleshooting permissions with the JIRA admin helper

The JIRA admin helper can help you diagnose why a user can or cannot see a certain issue. This tool is only available to JIRA administrators.

To diagnose why a user can or cannot see an issue:

  1. Choose at the top right of the screen.Then choose Add-ons > Admin Helper > Permission Helper.
    (tick) Keyboard shortcut: g + g + start typing 'Permission Helper'
  2. Enter the username of the user (leave blank for anonymous users), an issue key (for example, an issue that the user can/cannot see) and the permission to check.
  3. Click Submit.

Screenshot: Permissions helper (click to view larger image)

32 Comments

  1. I think a reason somebody would TRY to do this would be to grant "all authenticated" users login access to Jira.  If Jira is configured to use an external identity directory (LDAP/AD), what is the correct way to grant "all authenticated" users login access to Jira?

  2. Anonymous

    It is remarkable that there is no separate global permission for disabling password changes by users (or even better a switch in the User Creation/Detail page). Quite a rounded product...until you get in the corners. A.R.

    1. That's part of the External User Management setting

  3. Anonymous

    Hi there,

    Anybody knows how to remove the JIRA System Administrators permission from the jira-administrators group ?

    Cheers,

     

    1. Hello there,

      The steps on how to do this are already described above. However, I've tweaked the content slightly to make this section a little clearer. Hope this now helps.

      Cheers,

      Giles.

      1. Anonymous

        Hi Giles,

         

        From Administration -> Global Permissions.

        Under JIRA Permissions, I can see JIRA System Administrators ( with jira-administrators & jira-system-administrators group )

        and JIRA Administrators ( with only jira-administrators group ).

        But, I have users with JIRA Administrators permission who can perform system admin, such as

        'Administration' > 'System' > 'License'  (the Add button is enable).

         

        What am I missing ?

         

        Cheers.

         

        1. Hi there,

          It looks like you may have missed step 4 (above). Have you tried removing the JIRA System Administrators global permission from the jira-administrators group?

          Then, assuming that:

          1. You have one user (e.g. with username sysadmin) who is a member of the jira-system-administrators group (which in turn has the JIRA System Administrators global permission)
            AND
          2. You have another user (e.g. with username normaladmin) who is a member of the jira-administrators group (which in turn only has the JIRA Administrators global permission and not the JIRA System Administrators global permission),

          Then,

          • Log in as sysadmin and you should be able to access the License page.
          • Log in as normaladmin and you should not be able to access the License page.

          I hope this resolves the issue?

          Cheers,

          Giles.

          P.S. One strategy that might help is to think of users or groups in JIRA 'as having' (or 'with') various permissions, as opposed to permissions 'as having' / 'with' users/groups.

          1. Anonymous

            Hi Giles,

            Thanks for your reply.

            Certainly I miss steps somewhere, but my question is HOW to remove  the JIRA System Administrators global permission from the jira-administrators group ? I'm sure from 'Administration' -> 'Global Permissions', then what ?

             

            Cheers

             

            1. Hello again,

              You have a good point there (smile)

              I've added a short procedure above entitled Removing global permissions, which should hopefully explain how to remove global permissions from groups.

              Cheers,

              Giles.

              1. Anonymous

                Hi Giles,

                 

                Yes, that's it, thanks.

                 

                Cheers.

  4. Would it be safe to assume you can't give the 'Jira Systems Administrator' global permission on an OnDemand instance?

    1. Hi Toby,

      Yes, that's right. The 'JIRA System Administrator' global permission is restricted in Atlassian OnDemand.

      p.s. This page might be interesting too you: Managing application permissions. – Regards, Lingbo

  5. Anonymous

    Hi,

    Understanding its flexibility - I was confident that it was possible for me to have admins for users within projects (i.e. have a projectX-user-admin in addition to the global admins), but after reading through quite a bit of material it seems that this is not possible.

    Please confirm whether this is true - that it is NOT possible.

     

    ./faz

     

  6. Hi,

    I'm trying to separate 'JIRA System Administrators' from 'JIRA Administrators' Group.

    Followed the below:

    1. Created "jira-system-administrators" Group and Added members to this new group.
    2. Granted JIRA System Administrators Global Permission to the new group "jira-system-administrators"
    3. Deleted "jira-administrators" Group from "JIRA System Administrators Permissions"
    4. Delete Users from Group "jira-administrators"....who are now part of "jira-system-administrators"

    I have a users with JIRA Administrators permission who is able to perform all system admin tasks (General Configuration, Global Permissions, STMP Mail Server, License Details and Plugins....He's able to access and edit all these options).  

    Can someone pls help....not sure what I'm missing out on?

     

    MBoosa-

  7. Hi!

    Is it possible to create another kind of administrators who can create a project, manage the members of their projects, choose which ways of the workflow will be used for their projects but who cannot do the other administration tasks as create a workflow?

    Thanks

    Helena

    1. Anonymous

      This is truly a crucial question, thanks for putting it out there Helena! (smile)

      If seen a few sites strggling hard with JIRA global permissions. ANd, as soon as you get more than, say, ten different projects, you will get a swamped doen JIRA global admin support service unless you grant the users (project administrator users that is) working in non-standard processes on the same JIRA server instance the global permissions...

      Which means you get a totally un-coordinated misch-masch of decision makers and editors of workflows, issue types and the likes...

      It would REALLY be helpful (read it as nescessary) to get down on a project role level, having full permissions to change what not concerning the project - without affecting the other projects definitions, nor the global system administrators feeble attempt to keep up with the flood of change requests (or de facto changed definitions, unaware until a fact (tongue) )

       

    2. YES!  We need this, too.  I don't want other teams to be dependent on my team to create new projects.

    3. Anonymous

      Yes, completely agree. This is desperately needed. Can anyone at Atlassian speak to whether this is even on the roadmap?

      1. You may want to follow this ticket:  JRA-3156 - Required: Project Group Administrator Open

        Kind regards,
        Andrew 

  8. Anonymous

    Hello,

    In the above documentation it says in the table; "JIRA Users: (warning)   The number of users that count towards your JIRA license is the sum of all users (including users in groups) that have this permission." I get the impression that only users that have JIRA Users global permission (visible under 'View Users' in the JIRA Users row), count on the license ).

    In my system jira-users is the only group with JIRA User permission. I also have an administrator user that only have JIRA system administrator and JIRA administrator global permission. Should not the license count be the same as the number of jira-users then?

    Regards,

    Mattias

  9. is it possible to restrict user from sharing dashboard?

  10. Anonymous

    rHi,

    The person whose user account was created during the JIRA Setup Wizard and who is a member of the jira-administrators and the JIRA System Administrators group now needs to be removed from both of these groups and the JIRA system administrators permission needs to be given to someone esle. Can anyone tell me how this is done? Thanks.

    1. Remove the userid from the jira-administrators group and deactivate the user in JIRA as usual. To change the OS userid that the JIRA process runs as depends on the OS.

  11. I am a bit confused how admins (as opposed to system admins) have the power to install plugins. I have not tested this, but this action is not listed in the exclusions above so assuming it's the case.

    If an admin can install a plugin, a plugin can do anything such as give that user access to the server as the account JIRA is running under, and from there it's pretty trivial to get the db read-write connection details, and from there add any user to the system admin groups etc. Adding plugins seems like it should be restricted... if not, why not?

    cheers, jamie

    1. In fact they can't, which makes sense, so that should just be added to the list above.

  12. "Not a member? To request an account, please contact your JIRA administrators." Now who are the JIRA administrators here ?

    • jira-administrators   or
    • jira-system-administrators

    all I want is when someone fills out the Contact Site Administrators form, the email should be directed to jira-system-administrators and not jira-administrators, please help.

    P.S - I have checked this link - How to Edit the 'Contact Administrator' Page in JIRA 4.1.1 and Above , but it doesn't seem neither clear nor informative.

  13. I'm trying to restrict a particular user to one specific project only. There appears to be no simple way to do this. Should really be a simple matter of assigning users to a project, but after an hour of reading documentation I haven't made any headway.

  14. Anonymous

    Can I add a custom permission.  

    Example i want to create a permission with name approval, this permission will be used only in the workflow condition where users with this custom permission can perform action. 

  15. Is the JIRA admin helper available only to System Admins? 

    Choose  at the top right of the screen.Then choose Add-ons 

    I have an Administrator account (no System Admin), but i'm unable to see the Add-ons option.

    Clicking on  only shows me: 

    Administration
    Projects

     

    1. Hi Aileen,

      I checked with the developer and this functionality is not restricted to System Admins. Is it perhaps not enabled because of a custom field setup? Honestly, it's hard to know from this end what may be the issue, I think your best bet would be to contact someone in JIRA Support for help troubleshooting this.

      Thanks,

      Susan