Managing Global Permissions

Granting global permissions

1. Log in as a user with the JIRA Administrators global permission (or the JIRA System Administrators global permission, if you need to grant the JIRA System Administrators global permission).
   By default, the user account created during the JIRA Setup Wizard has both of these global permissions.
2. Choose > System. Select Global Permissions to open the Global Permissions page, which lists JIRA's global permissions.
   Keyboard shortcut: g + g + start typing global permissions
   
   The Add Permission box is shown at the bottom of the list (not displayed in the screen capture above).
3. In the Permission dropdown list, select the global permission you wish to grant.
4. In the Group  dropdown list, either:
   
   • select the group to which you wish to grant the permission; or
   • if you wish to grant the permission to non logged-in users, select Anyone. This is not recommended for production systems, or systems that can be accessed from the public Internet such as JIRA Cloud,
     Please Note:
     

     • The JIRA Users permission (i.e. permission to log in) cannot be granted to Anyone (i.e. to non logged-in users) since this would be contradictory.

     • The JIRA Users permission cannot be granted to groups that have the JIRA System Administrators or JIRA Administrators permissions.

     • If you have a user limited license (e.g. personal license) and have reached your user limit, you will not be able to grant the JIRA Users permission (i.e. permission to log in) to any further groups without first reducing the number of users with the JIRA Users permission.

Removing global permissions

1. Log in as a user with the JIRA Administrators global permission (or the JIRA System Administrators global permission, if you need to remove the JIRA System Administrators global permission).
   By default, the user account created during the JIRA Setup Wizard has both of these global permissions.
2. Choose > System. Select Global Permissions to open the Global Permissions page, which lists JIRA's global permissions.
   Keyboard shortcut: g + g + start typing global permissions
   For each global permission in JIRA (indicated on the left of this page), groups which currently have that permission are shown on the right (under the Users / Groups column).
3. Locate the global permission you want to remove from a group as well as the group you want to remove that permission from (under Users / Groups) and click the Delete link next to that group.

About 'JIRA System Administrators' and 'JIRA Administrators'

People who have the JIRA System Administrators permission can perform all of the administration functions in JIRA, while people who have only the JIRA Administrators permission cannot perform functions which could affect the application environment or network. This separation is useful for organisations which need to delegate some administrative privileges (e.g. creating users, creating projects) to particular people, without granting them complete rights to administer the JIRA system.

People who have the JIRA Administrators permission (and not the JIRA System Administrators permission) cannot do the following:

• Configure JIRA's SMTP mail server for notifications (but they can configure POP/IMAP mail servers for the receipt of email messages that create issue comments and new issues, and fully administer email notification schemes).
• Configure a CVS source code repository (but they can associate a project with a configured repository).
• Configure listeners.
• Configure services (except for POP/IMAP services).
• Change the index path (but they can reindex and optimise the index).
• Run the integrity checker.
• Access logging and profiling information.
• Access the scheduler.
• Export/backup JIRA data to XML.
• Import/restore JIRA data from XML.
• Import XML workflows into JIRA.
• Configure attachments (but they can set the size limits of attachments and enable thumbnails).
• Run Jelly scripts.
• Add gadgets to the Gadget Directory.
• Configure user directories (e.g. LDAP).
• Configure Application Links that use an authentication type other than OAuth.
• View user sessions.
• Access license details.
• Grant/revoke the JIRA System Administrators global permission.
• Edit (or Bulk Edit) groups that have the JIRA System Administrators global permission.
• Edit, change the password of or delete a user who has the JIRA System Administrators global permission.
• Upload and/or install an Add-on.

It is recommended that people who have the JIRA Administrators permission (and not the JIRA System Administrators permission) are not given direct access to the JIRA filesystem or database.

Separating 'JIRA System Administrators' from 'JIRA Administrators' in default JIRA installations

By default, the jira-administrators group has both the JIRA Administrators permission and the JIRA System Administrators permission. Also by default, the user account created during the JIRA Setup Wizard is a member of this jira-administrators group.

If you need some people to have only the JIRA Administrators permission (and not the JIRA System Administrators permission), you will need to use two separate groups, e.g.:

1. Create a new group (e.g. called jira-system-administrators).
2. Add to the jira-system-administrators group everyone who needs to have the JIRA System Administrators permission.
3. Grant the JIRA System Administrators permission to the jira-system-administrators group.
4. Remove the JIRA System Administrators permission from the jira-administrators group.
5. (Optional, but recommended for ease of maintenance) Remove from the jira-administrators group everyone who is a member of the jira-system-administrators group.