User List Macro deprecated?

[Jesse Ram]

Hi there,

Can you continue the use of this macro? It is extremely useful and allows the project managers to oversee the users who have access to a specific space. The alternate method here (https://support.atlassian.com/confluence-cloud/docs/learn-which-macros-are-being-removed) is not an appropriate method - we manage access via admin managed groups not teams. 

Thank you for your consideration.

[Stephen_Lugton]

There's an existing feature requests to not deprecate this macro: Not disable Disable/Remove User List Macro from Confluence.  You can add comments and vote for the FR so that it gains visibility ( the comments and affected customers are visible to product team directly).

---

I also asked about this, Cloud Support came back with:

Current Situation:
The User List macro is being deprecated due to security concerns, as it allows for user group enumeration, which could potentially be exploited by attackers. This decision is aimed at enhancing data protection and security within Confluence.

Alternative Solutions
As of now, there is no direct replacement macro announced to replicate the exact functionality of the User List macro. However, Atlassian is aware of the need for users to access certain information without having full admin privileges.

Here are a few suggestions to consider:

• Custom Solutions: You might explore creating custom macros or scripts that can provide similar functionality while adhering to security best practices. This would require some development effort and a good understanding of Confluence's API.
  
  For implementing custom solutions, please refer to the following resources:
  
  Creating User Macros: Writing User Macros
  Confluence REST API (v2): Confluence REST API Documentation

• Permissions Management: Consider reviewing and adjusting user permissions to allow access to necessary information without compromising security. This might involve granting specific permissions to trusted users or groups.
• Feedback to Atlassian: If this functionality is critical to your operations, providing feedback to Atlassian through official channels can help prioritize the development of alternative solutions or enhancements.

[Dirk Desmet]

Shows 'Unable to display request'.

[Barbara Szczesniak]

@Dirk Desmet What @Jesse Ram posted is a link to the support request, not a Jira ticket created in relation to it. Support requests are private between the requestor and Atlassian.

[marc -Collabello--Phase Locked-]

Hi @Jesse Ram ,

If you want that Atlassian reconsiders the deprecation, my advice is to open a support request.  Posts in this public forum often get no response from Atlassian.

[Barbara Szczesniak]

@Jesse Ram In addition to opening a support request, you are most likely to get the attention of the relevant Atlassian people by adding your concerns as a comment on the article you referenced in your question.

[Jesse Ram]

Hi @Barbara Szczesniak @marc -Collabello--Phase Locked- ,

Thanks for the tips, I've commented on the page and created a support request for the issue.

[Dirk Desmet]

Please share the link to the support request, so that we can vote.

[Jesse Ram]

https://support.atlassian.com/requests/JST-1121853