what are best practices for separating Confluence admins from Jira Service Management projects

[Jason Gorman]

In our company, Confluence is used as a collaboration platform among different departments and Jira Service Management by the IT department as a help desk ticketing system.  Many people were given the Confluence “Org & Site Admin” role and initially had access to Jira Service Management. To remove that access, I removed “site-admins” from the “jira-administrators” group in Atlassian Admin User Management.  Is that enough to prevent a Confluence site admin from accidentally accessing a project, making changes, or viewing tickets? Should additional steps be taken at the project Permission Scheme level? And how can I be certain that I haven’t overlooked some other way into Jira Service Management?

[Walter Buggenhout · Accepted solution]

Hi @Jason Gorman,

It's important to understand the way product and project/space access work across the different Atlassian products you have on board, look at your current setup and maybe redesign certain things from the ground up. Too many people being granted admin rights is a common mistake unfortunately, but can be fixed.

Confluence and JSM are different products, so licensed access (and the associated costs) are managed separately for each product. Navigate to your site's user management and check out the product access page. You will see which groups are granted access to which product (Confluence and JSM being listed separately).

Use the default groups there to grant people there license - this is normally done by default when you grant product access. For Confluence this normally is confluence-users, for JSM jira-servicedesk-users.

It is quite normal to have your site admins have product access as well, as it is their main role to administer the products. If you have too many admins, reducing that number is usually the right thing to do. 

On a final note, JSM is somewhat special in terms of access. Users with a Jira Software license will also be able to access projects (with limited permissions) if they are granted permissions in a project. But that does not go for Confluence users.

So in summary:

• remove the site admin permissions for people who shouldn't have them
• check the product access for JSM and Confluence in your site's user management
• product access is separate for Confluence and JSM
• product access grants people a license to use a product
• Jira Software users can view issues in a JSM project if they are granted access to that project; that goes not for Confluence users.

[Jason Gorman]

Thank you for the detailed posting.  It was very helpful.