How can I configure a project for my Legal Department who has privacy & visibility concerns?

[Shala Schultz]

I'm working to increase digital adoption of Jira Software within our company. Our Legal Department needs their project & tasks to be visible to ONLY the users they specify - even Jira Admins should not be able to see the tasks within their projects.

Is this possible by creating a Team Managed Project and then using Issue Level Security settings? Or will Jira Admins always be able to see the tasks in any project? 

[Karina D. · Accepted solution]

Adding my +1 to this; Next gen would have been perfect for my legal department except for the issue-level-security issue. Atlassian should keep in mind that non-dev teams (particularly cost center's like Legal) aren't at the top of the 'we need work done in Jira' hierarchy in our respective companies, so allowing Legal Ops to self-serve with more customizable permisioning in team managed projects would overcome this huge obstacle for usage.

[Shala Schultz]

Hi @Karina D. agreed. The solution took some configuration and anytime a new team member is added to the Legal team, we will need to manually add them to the settings I created to ensure as much privacy as possible. As an update to this post, here are the settings I ended up going with:

• Created a new Project Role called Legal Team Member.
  • Then I added the specific individuals on the team as Default Users. 
• Created a new Permissions Scheme called "Legal Department".
  • For the "Browse Projects" setting I added the individual usernames. I could have done this by a group or by that Project Role, but I wanted to go down to the individual user here so someone on my IT team doesn't accidentally add someone to a group or Project Role and not realize what kind of access they were giving. 
  • For most of the remaining settings I set it as Project Role = Administrators or Legal Team Member. 
• Created Issue Level Security Schemes:
  • I created the default level to be for all the Legal Team Members to view and again went down to the individual username level for this setting. 
  • I created an additional level for the head of our legal department in case there were issues he needed to add to projects for only himself to see.

[Nic Brough -Adaptavist- · Accepted solution]

Team managed projects do not have issue level security, so I think that may be a non-starter for you.

For both team and company managed projects though, the key is who you let into the project.

Team managed projects have simple roles, and the way to prevent someone seeing the project is to not add them to it.

Company managed projects have permission schemes, which are rules on who can do what.  The important one here is who has "browse project" permission, and the best option for you here is to set that to something like "Role: developers" (instead of the default of "any logged in user").  Then your project admins can add and remove whomever they want in the role.

Admin rights give people admin rights, not "can do anything".  If you don't put an admin in the developer role, they can't see the project or its content.  But as they are admins, they can add themselves or change the permissions.  

[Shala Schultz]

Thank you @Nic Brough -Adaptavist- !