How to restrict the ability to view and update license from Confluence system admin

[Tran Van Huu]

Dear community,

I'm Confluence system admin of an instance with 15k users.
We have 5 system admin here but I'm the only one who manage the license.
I know that whenever a System admin applies license, the license key decided to play hide and seek - invisible to my admin senses!
But other admins have this sneaky talent to "update" the licence and perform the 'save' dance --> I want to prevent this case.

Based on your professional experience, I'd like to ask if there is any thing that I can do like making some customzation or using a third party plug-in to make it.

Inconclusion, I'm as a main system admin can view and update the license key and the other admins can't make it.

Any suggestion is much appreciated.
Huu,

[Nic Brough -Adaptavist-]

You can not do it, nor should you want to.  The administrators job is to administrate the system, and that includes renewing licence keys.

If you think you want to stop your admins seeing a licence key, then you have defined their role incorrectly.  They probably should not be administrators.

You could go through the torturous route that @Ravina has described, but it is completely pointless, as your admins will have other ways to get to the key.

You should not have any need to do this too.  Why are your other admins applying licences?  Why is it a problem? 

You do actually need to allow other people to be admins - never have fewer than three people with admin access (you should always have two backup people, even if they only have it so they can add a new admin when you leave)

[Ravina]

Hi @Tran Van Huu As this is not available by default the possible ways I can think of through the proxy server or load balancer your Confluence datacenter is using.

If your Confluence site is using the standard load balancer then you can work with your network/load balancer team to block the below link and only allow your IP address to access the same, 

https://your-confluence-fqdn/admin/license.action

If your Confluence DC site is using any WAF or CDN application in front of your site like Akamai or CloudFront then this URL blocking can also be done there.

Also, it's better to review the detail comparison between confluence administrators and confluence-system-administrators and if those other system admins does not work on any functionality which confluence-system-administrators do then you can reduce their access to confluence-administartors to avoid this license update thing

https://confluence.atlassian.com/doc/global-permissions-overview-138709.html#GlobalPermissionsOverview-confadmin

Thanks

Ravina