Site Admin permissions to projects are restricted on Free Plan. Is it by design or bug?

[Yevhen Khrapach]

I'm Site admin and Jira Admin but seems I don't have ALL permissions in ALL projects. 
There is a company-managed project and It is impossible to change the project's permissions or roles on Free Plan. And the Permission helper says "You is not a member of any of these project roles: Administrators, atlassian-addons-project-access" for many permissions on the project. For example, I don't have "Administer Projects" permission. It doesn't take into account that I have "Admin access" to Jira. 

That's look like a bug. 

What if actual project's admin will be killed? How will I be able to do any administartion in the project?

[Trudy Claspill]

Hello @Yevhen Khrapach 

As others have noted, with the Free plan you don't have access to customize permissions or add users to Roles. Reference

https://support.atlassian.com/jira-cloud-administration/docs/what-is-the-free-jira-cloud-plan/

Note in that document it says that every user that is granted access to Jira Software gets Administrator access for all the projects. There is no need to grant a user any specific permissions.

So, the question is, exactly how have you been designated a Site Admin and granted access to the Jira Software product.

Atlassian started rolling out changes to user management, so not all Organizations have the same experience. It will be challenging to figure out exactly what is happening with your site without screen images.

Let's start with this. Are you able to access https://admin.atlassian.com? If so, so you get prompted to select an Organization? That will happen only if you have access to more than one Organization.

Assuming you do have access to the admin hub, what options do you see?

Can you select Directory and select Users?

Can you find your own user account and display the details for it?

[Trudy Claspill]

I was reviewing your post again an I noticed you said this:

And the Permission helper says "You is not a member of any of these project roles: Administrators, atlassian-addons-project-access" for many permissions on the project.

The default permission scheme for Company Managed projects in Jira sets all permission to be available to 

Project Role
- atlassian-addons-project-access
Any logged in user

The message indicates that somebody has changed the permissions scheme so that it is instead

Project Role
- Administrators
- atlassian-addons-project-access

This would be a problem.

It is, indeed even in the free plan, possible to create a permission scheme like that, and then associate that permission scheme to Company Managed projects. I've done that as an experiment.

When that occurs, a user would have to be explicitly added to the Administrators role in the project to have the permissions. But in a Free plan users are not explicitly assigned to any roles. So the impact is that the user loses access to the permissions in that project. To ensure that all users have permissions in the projects, the Any logged in user option has to be set for all the permissions. Wherever that is missing in the Permission Scheme for Company Managed projects in a Free plan, all users will not have that permission in that project.

So, for a project where you are having this problem, let us start by confirming what type of project it is. Please go to the Projects menu and select the View all projects page and find the project in the list. Tell us what it says in the Type column.

Next we need to look at the permissions for the project. If you are a full Jira Admin, go to the gear icon and select Issues. Then select Permission Schemes. Find the name of the project in the Projects column. Click the Permissions link on the left near that to display the Permission Scheme details for that project.

If you don't find the project name on the above page, that could mean it is a Team Managed project instead, which will require different steps to diagnose.

When you have the Permission Scheme for the project displayed, grab a screen image particularly for the Administer Projects permission. Share that screen image with us.

[Yevhen Khrapach]

You say "Note in that document it says that every user that is granted access to Jira Software gets Administrator access for all the projects. There is no need to grant a user any specific permissions." But that doesn't work in fact. Because I DO NOT HAVE access to all Jira functionality for the specific project that was created years ago.

>how have you been designated a Site Admin and granted access to the Jira Software product.
I created the site and organization on Attlassian at 2017. So I'm "organization administrator" and "Site administrator".

>Are you able to access https://admin.atlassian.com?

Yes.

> If so, so you get prompted to select an Organization? 

I have only one organization.

>Can you select Directory and select Users?

I can access Directory but i do not have Verified Domain.

I can access USER MANAGEMENT for all Products of the organization and I can manage users and  groups there. 

>Can you find your own user account and display the details for it

[Yevhen Khrapach]

Project type is "Company-managed software". It was created before Team-managed software projects were introduced.

I will make screenshot about permissions scheme and Permission helper dialogue.

[Yevhen Khrapach]

"Permissions scheme" you have asked for:

Permissions from "Project settings":

Permission helper sample output:

[Trudy Claspill]

I also am on a Free plan and don't have a verified domain. But I have a different user management interface than what you have. I also created the Organization so am the Org Admin and Site Admin

As I mentioned, Atlassian has been rolling out some changes, so not all interfaces will look the same. It makes this very challenging to diagnose as we have to ask you to provide screen images and details. 

If I click the gear icon in Jira and select User Management, I end up in the Admin hub on a tab labeled Directory, shown below, and the page lists the users of the site farther down.

I have Centralized User Management. It looks like you have the original user management still. You can read more about that here

https://support.atlassian.com/user-management/docs/give-users-access-to-products/

I consult for others where they have paid subscriptions and Original User Management.

If you click on the Products tab at the top of the admin hub, then in the panel on the left do you see your Site listed? And if you click on that, in the new panel on the left do you see an options for Product Access? 

It is possible that the allocation of product access to the Site Admin group has gotten messed up. There are actually two products to which you get access as an Admin; Jira Software and Jira Administration. I can see that by going to Directory and Groups, and looking up site-admin.

Notice that the group has a role assigned for Jira Administration, giving members of the group admin access to Jira, and a separate role assigned for Jira Software. It is actually possible to remove the role for Jira Software, leaving the group members with admin access to Jira but not "user" access to Jira.

[Yevhen Khrapach]

You mentioned "To ensure that all users have permissions in the projects, the Any logged in user option has to be set for all the permissions. Wherever that is missing in the Permission Scheme for Company Managed projects in a Free plan, all users will not have that permission in that project."

Seems it is my case. I think that should have been set automatically for standard schemes during introducing of the limitations for Free Plan. Is there simple way to set Any logged in user for all permissions?

BTW. But I steel think that Site/Product Admins should not dpendend on this "Any logged in user option" and should just have access to all features allowe by Plan.

[Trudy Claspill]

Thank you for the info you are providing in your replies. This is very helpful.

So, the problem is definitely the permission scheme associated with the project. The Administer Projects permissions has been limited to the Administrators role.

Since users are not actually assigned to roles in the free plan, this prevents anybody from administering the projects that use this scheme.

I see in my own Free environment that the "Default software scheme" is identical to yours. But I also see that every time a new project was create a new Permission Scheme was also created for the project. And in each of these new Permission Schemes, the Administer Projects permission is allocated to Any logged in user and the addon role.

So, to correct your issue you can see if you can edit the Default software scheme Permission Scheme to change the Administer Projects permission, or you can try creating a new/copied scheme, editing the Administer Projects permission, and then associate that to the two projects currently using the Default software scheme.

[Trudy Claspill]

BTW. But I steel think that Site/Product Admins should not dpendend on this "Any logged in user option" and should just have access to all features allowe by Plan.

We could go into a philosophical and technical discussion on this, but I don't feel that it is a good use of my time. There are multiple technical factors at play here, and at the end of the day a user that has the Product Admin role will be able to make changes the necessary changes to grant themselves access because they can change Permission Schemes and change the association of schemes to projects.

[Yevhen Khrapach]

Yes. Seems i have "Original" user management.

>And if you click on that, in the new panel on the left do you see an options for Product Access? 

I see option but UI is different to your. Especcially "Product Access" in the middle part (you have "5" there) is missing.

And I can't find "Group product access at all"

[Yevhen Khrapach]

"Default software scheme" can't be edited or copied :( 

"Default Permission Scheme (Any new projects that are created will be assigned this scheme.)" may be copied. 

I will compare the schemes and will try to make new scheme with corresponding changes at morning. 2:40 AM is too late for such tasks :)

BTW.

Not all permissions of "Default Permission Scheme" has "Any logged in user" option checked. Is this correct for Free Plan? That scheme is used only as a template for new projects as I understood.

[Trudy Claspill]

Ok. In my system I don't have a "Default Software Scheme" but I do have a "Default permission scheme" that can be edited and copied.

Did you possible migrate projects from another environment into your Free Jira Cloud instance? I ask because "Default Software Scheme" is a name I've seen in Jira Server/Data Center, but not in a brand new Jira Software Cloud Free instance.

I also see in my "Default permission scheme" that not all permissions are granted to "Any logged in user". However in each permission scheme created automatically when new projects are created I see that in fact all permissions are allocated to "Any logged in user". So, if the "Default permission scheme" is allocated to actual projects, I think you will need to set all the permissions to "Any logged in user".

The alternative is to create a copy of the scheme, change all permissions to include "Any logged in user" and then associate the new scheme to the two projects currently using the "Default permission scheme".

[Nikola Perisic]

Hello @Yevhen Khrapach 

Project roles become useful when you add people to a specific role. Users are not available in the free plan.

And also the permissions are not available on the free plan as well. You can subscribe to the free trial of Standard version of Jira, where you will be able to have the permissions and users.

After you are done, you can cancel your subscription.

[Yevhen Khrapach]

Your answer looks strange to me.
Project Roles exist and Users exist and Permissions in all plans. Free plan has only limitations on their management. 
If users and permissions are unavailable Then how do I not have PERMISSION and another USER has it (thats that Jira UI says to me)? 
About temporary subscription that you propose. I don't need some special permission on a special Issue. I just need general permissions (unlimited) as Site/Jira admin. Do you think it shouldn't be allowe in Free Plan?

[Aaron Pavez _ServiceRocket_]

Hi @Yevhen Khrapach 

Free plans have several limitations mentioned here:

https://support.atlassian.com/jira-cloud-administration/docs/explore-jira-cloud-plans/

The biggest one is that you cannot modify/add any new permissions.

If you need permissions, you need to jump to a Standard plan.

Regards

[Yevhen Khrapach]

I don't need some specific permission on specific Issue what Standard plan is about. I don't want to configure permissions at all.

I just want as Site/Jirs Admin to do any possible modifications that another users may do on my site. For me it looks logical to give Admin all permissions if Role/Permissions model is simplified on Free plan.

It was Permission/Role management available on Free Plan some time ago as I remember. Another user was set as a Project Admin and he is able to delete Issue in the project. I don't know was I able to delete issue or not before the limitations introducing but I was able to add myself to Project Admin role. And now I can revoke access to site (same like deletion) for user that can delete an issue but I can't delete an Issue myself and can't set any other User to be able to delete an Issue. This means that not only Permissions, roles, and issue-level security are limited but basic functionality is limited. And that's looks like a bug.

[Sivakumar Kunjithapatham]

I have also hit the same issue. I am a Site Admin in the Free Plan, but I am not able to edit the project permissions. I feel left out by JIRA.

[Nikola Perisic]

Hi @Sivakumar Kunjithapatham 

Please find all of the information here: https://support.atlassian.com/jira-cloud-administration/docs/what-is-the-free-jira-cloud-plan/