Why any user belongs to jira administrators group get a list of all projects

[MJ Jafari]

I'm in the process of setting up JIRA Core cloud for our company , I have created all the required projects with the relevant permission schemes which are tied to certain users.

as soon as I add any user to the jira administrators group, that user can see a list off all projects in the system, without being on the permission scheme for any of those projects.

is this normal ?

I need to enable two users to create projects so we don't have to rely on site admin, that's why I added them as administrators , but I don't want them to see a list off all projects , is this possible?

[Scott Theus]

Hi @MJ Jafari ,

I'm not sure if this will work; I haven't tried it yet. But...

If you add the user to a group and give them the Jira-Admin role, but do not give the group the "Browse Projects" global permission then the user may be able to create projects without seeing the full list of projects, and add that group to your security schemes

Add the user to another group with admin access and give that group "browse Projects" access, then add the group to just the security schemes for projects you want that user to access. 

Good luck, let me know if this works for you.

-Scott

[MJ Jafari]

Thanks for your reply Scott, 

before trying to find a solution to this, does this mean the "administer project" global permission , enables the user to see a list of all projects ?

it appears that the "administer project" global permission is required in order for a user to be bale to create a project.

[Scott Theus]

There are two different "project" level global permissions in force here...

Project permissions Explanation

Administer projects	Permission to administer a project in Jira. This includes the ability to edit project role membership, project components, project versions, and some project details  ('Project Name', 'URL', 'Project Lead', 'Project Description').
Browse projects	Permission to browse projects, use the Issue Navigator and view individual issues (except issues that have been restricted via issue-level security. Many other permissions are dependent on this permission, e.g. the 'Work On Issues' permission is only effective for users who also have the 'Browse Projects' permission.

(https://confluence.atlassian.com/adminjiracloud/managing-project-permissions-776636362.html)

I'm thinking that if a group or user  has "Administer Projects" permissions but does not have "Browse Projects" permissions then they will be able to create new projects, but not see the new or existing projects in the list. It's not until the user is added to the security scheme as part of a group with "Browse Projects" and that scheme is added to a project that the user will see the project(s) in the list. 

-Scott

[MJ Jafari]

@Scott Theus I understand your comment, the way I see it , "Administer Projects" and "Browse Projects" can be configured as part of a permission scheme which only applies to the specific associated project.

at the global level, I don't have the "Browse Projects" to disable for a given group , I only have below permissions 

Administer Jira

Browse users and groups

Share dashboards and filters

Manage group filter subscriptions

Make bulk changes

Create next-gen projects 

[Scott Theus]

My bad.....The "Administer Projects" and "Browse Projects" are Project permissions, not Global permissions.

Those are set through the permission schemes.

-Scott