Project default members and new users having access where they don't need to

[Javanshir Mustafayev _ HIT]

I have two issues, not sure if they are connected, but hope to get them sorted out with the help of the community:

1. When a new project is created in the People section there is always a member added with a role that is a custom role I use in one project only.

2. When a new member is added to Jira there are two projects by default that the user has access to. This can be seen in the user management -> View Jira Project roles

If I go to the project settings-> people, I don't see the new user as a member of this project but the user has these two projects listed and accessible in the UI.

How do I manage both of the issues above and configure the default project access where needed to who needs it?

Thanks

[David Freitez · Accepted solution]

Hi @Javanshir Mustafayev _ HIT

It seems that you have groups being granted access to a role in those projects, perhaps the jira-user group, so when you add the user to your instance, they automatically gain access to those projects since they are members of a group that is being granted a role in those projects.

Can you check if that assumption is correct ?

If so, they way to avoid it is to remove those groups from the People page and then you figure out how it would be better to grant them access.

It could be:

• Adding every user individually to the project, this can be done by a project administrator (no need to be a Jira admin).
• Grant the access to a group which is not the default access group (like jira-users) and add members when needed, so when you do, they gain access to the project. The difference here is that this group is not a default access group, so the users won't be added there automatically.

Kindly review my comments and let me know if you have further questions.

Regards,

David
ServiceRocket

[Javanshir Mustafayev _ HIT]

@David Freitez could you please share where I check this?

[David Freitez]

There are several things you can check:

• Jira User Management (https://support.atlassian.com/jira-cloud-administration/docs/create-edit-and-delete-users/), in this section you can check a user's group membership.
• The project's People tab, where you would check which users and groups have a role in the project.
• The Permission Scheme of the project, check the Browse Project permission so you can check what users/groups/roles are granted the permission in the project.

Checking those 3 items you'll be to understand better why the users are granted access to the projects when they are invited to the instance.

Kindly review my comments and let me know if you have further questions.

Regards,

David
ServiceRocket

[Samuel Gatica _ServiceRocket_]

HI @Javanshir Mustafayev _ HIT 

For the first issue, you may have the users added to the 'default members' for a project role, hence every time a new project is created by default the project will add those users. Please check doc Manage project roles Section -> Specifying 'default members' for a project role.

For the second issue, check the project access role and see if the users are members of the group with access, also check the project permission scheme and ensure the Browse permission access is granted only to roles and not everyone.

Regards

Sam

[Javanshir Mustafayev _ HIT]

@Samuel Gatica _ServiceRocket_ Hi,

Thanks for your reply:

For the first issue, you may have the users added to the 'default members' for a project role - that was the issue, the user that is being added to all new projects was a default member of the project role.

Removed the user from the default member, this should fix issue number one.

Stuck with the second one, could you please share more information on the topic?

[Thinks1234_]

but the first issue seems like a bug. because even I did not involve that role in my project, the default member will be a member of the new project. More, the default member will "hide" in some role that do nothing with your project and you have to check every role to figure out whether there is default member. Unfortunately, if some one have used the role with default member in their projects, then, you have to delete manually in your new project.