Is there a way to prevent Jira (and Confluence) admins from using the Atlassian MCP server?

[Matt Deimler]

There is a concern that a Jira user with elevated permissions, like a Jira admin, having access to and using the Atlassian MCP server, creates a risk. In short, we'd like a standard Jira user to be able to use the MCP server, but in some instances, block or prevent a user with elevated Jira permissions from using it. Is that possible?

[Marc - Devoteam]

Hi @Matt Deimler 

Welcome to the community.

Going over the documentation, I think not.

https://support.atlassian.com/rovo/docs/getting-started-with-the-atlassian-remote-mcp-server/ 

Within the article, there is a feedback suggestion option, provide your concern there.

But the same applies to the API and elevated user has more permissions than a normal user, this can't be denied to Jria admins as well.

In my opinion people with elevated rights should no the risks based on the elevated permissions they have.

And if it could be limited admins can't use the option, thant wold be strange, not?

[Matt Deimler]

Thank you for the reply.

[Vitalii Rybka]

Hi @Matt Deimler,

I understand the security concern, but as @Marc - Devoteam mentioned, this would be quite unusual from an access control perspective. Here's why this restriction isn't typically possible:

Technical Reality:

• MCP server access is tied to API permissions, which admins inherently need for their role
• Blocking admins from tools that regular users can access breaks the standard permission hierarchy
• Most enterprise security models assume admins are trusted with elevated access

Alternative Approaches:

1. Audit & Monitoring - Track MCP server usage through Atlassian Access logs
2. Role Segregation - Create specialized admin roles with limited API access for day-to-day tasks
3. Conditional Access - Use IP restrictions or device policies to limit where MCP can be accessed
4. Approval Workflows - Implement organizational policies requiring approval for MCP usage

Recommendation: Focus on governance rather than technical restrictions. Establish clear policies about when/how admins should use MCP, with regular access reviews and monitoring.

The feedback option Marc mentioned is definitely worth using - Atlassian might consider adding granular MCP access controls in future releases.

What specific risk scenario are you trying to prevent? That might help identify better mitigation strategies.

Feel free to DM me if you want to discuss specific security architectures!