Project template permissions

[Rocsana Chereches]

Hi,

I see that Jira has this new way of creating projects which provides a library of templates for different departments (it is no longer only next gen or software projects).

I thought that  only admins of the platform can see all templates and rest of the users can only see a few random templates. Today I talked to a user that has access to all templates.

As Admin, I would like sole control to creating projects - do you know how I can manage access to project templates for rest of users?

This is quite a new feature so all documentation I can find still related to next gen + software projects and I do not find it helpful.

Thank you

Rocsana

[Alexander Bondarev]

Hi, @Rocsana Chereches !

You can remove "Create next-gen projects" permission from users through the Global Permissions Management - Manage global permissions :

Create projects separate from shared configurations and schemes. Next-gen projects don't affect existing projects or shared configurations like workflows, fields or permissions. Only licensed users can create next-gen projects.

Removing this permission does not delete existing next-gen projects.

Users with the Administer Jira permission can always create next-gen projects, even if that group is removed from this permission.

[Rocsana Chereches]

Hi Alex,

I did, but this does not stop users from creating projects.

For some reason it seems that we are using Jira Core's project templates and no longer just 'next gen' & 'software' so I assume the permissions you mentioned above does not apply in this case.

Are you aware if Jira made any changes from previous way of creating projects to Jira core?

[Daniel Ebers]

Hi @Rocsana Chereches

while there is a new experience for creating projects the permission management should not be affected in a negative manner.

Could you please probably share a screenshot what a, non-privileged user, is seeing when trying to create a project?

Do they see all project templates or solely only them related to Jira Core (now: "Jira Work Management")? Even that type of project is bound to permissions as far as I know from the past.

Regards,
Daniel

[Rocsana Chereches]

Hi Daniel,

Thank you very much for your reply. 

Can you please define what a 'non- privileged' user is? For my company's platform there are only 2 admins and if I am not mistaken, these should be the only two people that are allowed to create projects once you turn off the ability to create 'next gen projects', as Alexander Bondarev mentioned above. 

Here is a screenshot of what a user can see. The user is not an admin of the platform but he is a project lead and when he wants to create a project, these are the options for him.

I'm not completely sure why we cannot create next gen or software projects anymore, instead we have these options above (I guess this is Jira Core).

Any explanation would be valuable!

Rocsana

[Daniel Ebers]

Yes, when there are only administrators available, and you have no further accounts, then they will be allowed to create projects (Users with the Administer Jira permission can always create next-gen projects, even if that group is removed from this permission.).

When you click on Jira Software, for example, there will follow another screen ("page"), there you will have the possibility to choose between a new company managed project or a new team management projects - assuming the permissions are set to do so.

Just testing on my instance I could see that an user without Jira administrator permissions (membership in "jira-administrators" group) they can create team management projects when the permission was set so.
As soon as I adjusted "Global Permissions" to forbid creation of team management projects an user not holding administrator permissions was not able to do so anymore (the option to browse the templates was not offered anymore at all).

I hope this would cover your question? I was not sure anymore after re-reading your initial ask - so please confirm if it helped or if anything is left unclear.

[Rocsana Chereches]

Hey Daniel,

One part of your answer I do not seem to understand is the very first paragraph. Would you mind explaining again? I am not familiar with this.

Everything else makes perfect sense and is super helpful. Could you please tell me how to get to these global permissions as I would like to ban project creation for anyone but myself and my boss (both admins of Jira). 

Thank you so much

Rocsana

[Daniel Ebers]

The first paragraph refers to the global permissions that you can adjust if you are one of the Jira administrators (which we understood this would be the case).

It is the part Alexander mentioned earlier:

You can remove "Create next-gen projects" permission from users through the Global Permissions Management

https://support.atlassian.com/jira-cloud-administration/docs/manage-global-permissions/

Doing so it should be easy to have only administrators create team managed projects.

After revoking the permission in "Global Permissions"...

a simple Jira user in my Cloud instance was not able to generate a new team managed project anymore (there were not "Create Project" button anymore). The button vanished as he is no administrator he literally could not create a company managed project and by the setting shown above he also could not create a team managed project any longer, therefore Jira recognized the create project button is no longer of use.

Please note that team managed projects and next-gen projects are the same, they were renamed. It seems not everywhere the new title is in operation - which could be confusing for some time still.

Could you please check and confirm if it worked out?

[Rocsana Chereches]

Hey Daniel,

Thank you for above.

As I mentioned briefly above, the issue I am trying to fix is regarding a user that is not an admin nor in any admin-related groups in Jira but can still create projects. I have checked global permissions and I can see the following permissions that are project-creation related do not include the user:

These are only for admins and the user is not included. I wanted to investigate further and I checked individual permissions, where it clearly states that he does not have the ability to administer projects (which from what I read includes creating projects as well)

The only thing I can think of that would allow him to create a project is that he is one of these groups that for some reason I cannot edit the permissions for:

When I click on either of those hyperlinks, it takes me to the groups I have created. I can only see the system admin group, I assume the others are default Jira ones that have all users.

Is it correct to assume that because of Administer Jira permissions that includes creating projects, the user can still create projects? If yes, do you know how can I disable this?

Thank you and I appreciate your help.

Rocsana

[Daniel Ebers]

Yes, the "Administer Jira" is responsible for granting all listed users/groups the permission to create company-managed projects.
I understood you in a way you have users which still can create projects but are not listed in the permissions for "Administer Jira" and/or "Create next-gen projects". Is this correct?

Could you please confirm the user you want to have not creating new projects is not in any of the groups listed in "Users/Groups" from "Administer Jira" permission and also not in any group listed for "Create next-gen projects"?

Have you effectively tried with a logged in user of them to create a project? In last instance this should not work then - if it should please also raise a request with Atlassian support to let them double check what you have spotted (they likely something strange is going on with your configuration).

[Rocsana Chereches]

There are 4 groups under Administer Jira:

- system administrators

- atlassian addons admin

- site admins

- trusted users

Out of all these groups, I can control who is in the site admin group and trusted users. I do not know how to get to the atlassian addons admin and system administrators groups. Do you know how to access these last 2 groups?

The user is not part of the team-managed-next-gen projects group. 

I just realised that the user was a trusted user so I changed his permissions to basic and waiting on him to let me know if he can still create projects. If he still has the ability to create projects after granting him basic instead of trusted permissions, then I will raise a support ticket with Atlassian.

[Daniel Ebers]

I see this can be confusing sometimes but there is a nice overview of the several admin roles within Jira Cloud:
https://support.atlassian.com/user-management/docs/give-users-admin-permissions/

The group for addons should never be touched, it is just a technical group - to my knowledge there is no interaction possible with it.

The "Trusted User" Role grants the user access to Jira Admin features.

So to summarize: if the user which could still create a company-managed project is not with in at least one of the above mentioned groups - they should not anymore be able to create new projects.

[Rocsana Chereches]

Hey Daniel,

Once I removed the user from the trusted user group, he was no longer able to create projects.

I want to thank you for all your help, it was super useful!

Rocsana

[Daniel Ebers]

Great, Rocsana! Happy to hear that!
It is sometimes a bit easier when seeing the same screen, which is not possible by using the Community, but now I am happy that it worked out nevertheless :)

Regards,
Daniel