Give permission to all projects to administrator-users

[Farhaad_n]

Hi, 

In the Jira service desk, how can give access to all projects in one action?

I have multiple projects, when I create a user and assigned it to the jira-administrator group,

it cant view all projects in "Projects > View All Projects", until I go to every project and add the user to the "Service Desk Team" section in "Users and roles"

What can I do? I want when adding a user to the jira-administrator group, it can be able to view all projects without other action needed.

[Mohamed Adel · Accepted solution]

Hi @Farhaad_n 

Can you share a screen of your permission scheme ,I think your problem with Browse Project permission , you need to be sure jira-administrator  is added

Regards,

Mohamed Adel

[Farhaad_n]

tnx for reply @Mohamed Adel

Permission scheme of what project?

there are many permission schemes for many projects, for example, I send one of them:

[Mohamed Adel]

You need to update all relevant permission schemes by adding this group “jira-administrator” to browse projects permission 

[Farhaad_n]

so, what administrators project role does?

and how can I add group “jira-administrator” to all my schemes with bulk action?

[Mohamed Adel]

You can't "add jira-administrator" to all your schemes in bulk , you should do it one by one and it is recommended to have redesign your permission scheme where you can use shared one with different project roles upon your needs administrator is a project role where you need to grant the desired permission inside the permission scheme , don't get confused with the name

[Farhaad_n]

thank you very much

[Radek Dostál · Accepted solution]

For existing projects, you would need to automate adding the group to project roles or modifying the permission schemes, there is no one click button to do this.

For the future, you might want to add the 'jira-administrators' group to default Administrators project role actors: https://support.atlassian.com/jira-cloud-administration/docs/manage-project-roles#Managingprojectroles-Specifying'defaultmembers'foraprojectrole

This will basically ensure that each project you create contains the group, therefore having the project permissions (well, unless somebody removes the group, but that generally does not happen very much). The downside is if someone sets up notifications for the project role, then the group also gets spammed, in which case it's good to remove it.

The problem with JSD permission schemes is that they always get created anew with predefined permission actors. So unless you want to modify some core files, you would need to hook up a listener to modify the newly created project's permission scheme to add the group to the permission. Again, nothing entirely straight forward as you need some coding experience and have a plugin allowing you to react to ProjectCreated event in the first place (you could do it without a plugin but you would have to create a java class anyway so it's the same thing at the end of the day).

The truth is, there's simply no easy solution. You will generally be fine with the default project role actor for any new projects. If you need to set up notification for the Administrators role, simply remove the group to avoid the notifications. Trying to modify the permission schemes in an automated way will cost a lot of time and sweat if you're not familiar with events and listeners, or have a plugin (such as https://marketplace.atlassian.com/apps/6820/scriptrunner-for-jira?hosting=datacenter&tab=overview as usual) allowing to create listeners in an easy and comfy way.

Anybody added to jira-administrators should understand how browse permissions work, and be able to diagnose any permission related problems, otherwise there's a decent chance they'll end up blowing something up in the long run, accidents happen.

Lastly, I don't see the connection between needing to give them automatic browse access everywhere - that's not what the group is for. Administrators shouldn't use the "Browse" to search for projects, they have administration menu "Projects" which shows ALL projects - regardless of permissions. They should use that one for any administrative work, imo.

[Farhaad_n]

thank you very much