Give read access to all Jira boards of a project, write access to one

[Xavier Roy]

I have two projects, say Project A and Project B. In Project A, I have one board, PAB1, in Project B I have two, PBB1 and PBB2. I want to give read access to a user for all boards in Project B, so PBB1 and PBB2, and write access for one board in Project B, say PBB1. This user shouldn’t have any access to Project A and its board.

How can I manage this?

[Ste Wright · Accepted solution]

Hi @Xavier Roy 

I see three needs above:

• Restrict access to Project A / PAB1
• Read-access to Project B's boards - PBB1 / PBB2
• Write-access to Project B's board - PBB1

Just to be clear up-front:

• Restricting access to Project A / PAB1 is possible
• It's not possible to restrict write/read-access based on a board - only based on a project (see below for more options)

-----------------------

Project A - Restrict Access:

You can control access using Project Permissions. As a Jira/Site Admin:

1. Go to Jira Settings (cog in top-right) > Issues
2. On the left-hand menu, select Permission Schemes
3. If Project A has its own permission scheme, you can press "Permissions" on the right-hand side to modify it. If not, you might want to create a new one. I would suggest pressing "Copy" next to an existing Permission Scheme to create a new one - then pressing "Permissions"
4. Project access is based on the permission "Browse Projects" - press "Remove" next to this permission to remove broad access to the project
5. Next, press "Edit" and choose how you'd like to provide access. For example, you could use a user group (created and managed by Site Admins) or a Project Role (created by Site Admins, managed via a Project Admin).
6. Make any other permission modifications you wish to make.
7. If you created a new scheme - go to Project A and in the bottom-left corner, select Project Settings
8. Select Permissions from the left-hand menu
9. Press Actions in the top-right and select "Use a different scheme"
10. Change to your new permissions scheme

If you are creating a new user group or need new project roles for this scheme, manage this via:

• User Group: Jira Settings > User Management > Groups
• Project Roles: Jira Settings > System > Project Roles

Project A - Board Access:

If a user doesn't have access to view a project's issues, the board will show as blank. However, if you also want to hide the board.

As a Board Admin/Filter Owner:

1. On the board, go to options (3-dots icon in top-right) > Board Settings
2. Select General from the left-hand menu
3. Press "Edit Filter Shares"
4. Ensure "Shares" is limited to Project if you just want users with project access to see it. You can also choose a user group.
5. If removing from "Shares" - press the trash can next to the existing option. To add, select the appropriate options from the drop-downs - press "+Add" and then "Save"

-----------------------

Project B:

It's not possible to limit edit access based on a board. A board is just a visual representation of an issue filter. You can restrict board visibility using the same instructions as above.

Permissions are all decided from a project-level. 

Depending on your scenario - some options are:

• Restrict Edit: Following the steps above, remove "Edit" access from Project B for a group of users. This would remove edit access from all issues though, not just a selection.
• More Projects: Split Project B into two projects - and modify permissions based on who needs access to what.
• Workflow: If the need is based on issue types, you could create a separate workflow for the "restricted" issue types, and limit edit access using a workflow property.

-----------------------

If you could provide us some further information about the need in Project B, we'd be happy to try and find a solution :)

Ste

[Xavier Roy]

Hi @Ste Wright ,

Thanks for the detailed answer, this is very helpful.

Project B is a product we are developing and boards PBB1 and PBB2 would be two clients we develop this product for.

Ideally a developer of Product B should have the permissions to follow the development made on PBB1 and PBB2 and edit only the development they’re doing themselves on, say, PBB1.

The way I’ve created and deal with these two boards PBB1 and PBB2 is as follows:

• from the original board of the project, say PBB0, create an Epic ticket referring to a client,
• create a board and update the filter with the field epicParent set to the link of that Epic ticket,
• create user stories and subtask with parent that epic ticket.

This is a good framework so far, but I’m in now way restricted to it.

Commenting on your bullet points:

• Restrict Edit: This would be too strong for us, we would need edit permissions on the development for one customer.
• More Projects: In practice we have more than two customers for Project B, and more then 2 projects; this would make the overall tracking too involved for us.
• Workflows: This looks like it may be the way to go.

Thanks for the link on that last bullet point, I’m not familiar with how these work, does it sound like the framework I’m using could use the workflows?

I’ll have a read at the doc you linked to, thanks again.

[Ste Wright]

Hi @Xavier Roy 

If you were to use the workflow option, you'd need a separate issue type per edit restriction - so it just depends how many limitations you need to apply.

Another option you have within the same project is Issue Security - it is visibility rather than just edit access, but offers some flexibility within the parameters of the project itself.

Ste