Can admin rights override other permissions?

[Jim Stewart]

We are migrating from Zendesk to Jira Service Management. One of our first beta users will be HR. As you can imagine, much of their information is confidential. Tickets will go directly to them and so not only might there be confidential information in those tickets but there are definitely articles in Confluence that should be seen only by full-timers or contractors or whatever.

We know we can set permissions to do this. But our concern is that site and org admins will be able to see documents they should not see. Is there a way around this?

[Alexis Robert · Accepted solution]

Hi @Jim Stewart , 

you can achieve this with Issue Security : https://support.atlassian.com/jira-cloud-administration/docs/configure-issue-security-schemes/

However, admin will always be able to modify the configuration and see those documents, but these actions will be added to the audit log.

So, even if someone does change some permissions to access these documents, there will be a trace in the logs : https://support.atlassian.com/jira-cloud-administration/docs/audit-activities-in-jira-applications/

Let me know if this helps, 

--Alexis

[Jim Stewart]

Hmm. So you're saying that yes an admin COULD see those documents and we would not know until after the fact. Is that the case? And if so, is that the case for both site and org admins?

[Nic Brough -Adaptavist-]

Yes.  An application administrator can amend any permission or security scheme they want to.  That is part of their job.

If you want to hide things from administrators, you need to put them in systems where those people are not administrators.

[Jim Stewart]

Hmmm, Ok, Thanks. We'll mull this one over.