Jira Cloud access, permissions, security: admin types and their privileges, global permissions, permission schemes, team-managed roles and work-level security.
Every point below comes from Atlassian's official documentation; each section lists its sources.
Think first How do you tell whether a task needs an org admin, a Jira admin or a space admin?
Why it matters: Questions describe an admin task and ask which admin type, or which permission, is the least needed to do it.
A Jira admin is anyone with the Administer Jira global permission. A space admin holds Administer Spaces for one space and handles that space's everyday details. Selecting or editing the space's schemes needs a Jira admin.
Step 2 of 9
Term
Meaning
Jira admin
A user with the Administer Jira global permission, needed to configure spaces.
Space admin
A user with the space-specific Administer Spaces permission, not necessarily Administer Jira.
Organization admin
An organization-level admin who can see space titles, but not content, in audit logs.
Space owner
Usually the space administrator; set to the space's creator by default.
Site admin
Another admin role that, like a Jira admin, can edit space keys and archive or restore both space types.
Step 3 of 9
Each admin type reaches a different level of Jira. Match the task to the narrowest admin who can do it.
What each admin type can and cannot do
Admin type
Example actions
Cannot do
Organization admin
See space titles in audit logs and security alerts; see hidden spaces
See space content in audit logs or alerts
Jira admin
Create company-managed spaces; restore or delete spaces in trash
View a space they created for an app they cannot access
Space admin
Edit name, description, avatar, URL, lead and role membership
Select or edit the space's schemes
Step 4 of 9
Space admins edit their space's everyday details. Without Administer Jira, they can still define components and versions. They can only view schemes such as the notification and permission schemes.
Exam trap A space admin cannot switch the space to another permission scheme. They can view schemes, but selecting or editing one needs a Jira admin.
Step 5 of 9
Company-managed spaces need Administer Jira. Team-managed spaces need the Create team-managed spaces global permission, which Jira admins control. Only Jira admins can create custom space templates or spaces with a shared configuration.
Exam trap Create team-managed spaces does not let a user create company-managed spaces. Those still need the Administer Jira permission.
Step 6 of 9
A space key change needs an organization, site or Jira admin. The same three can delete a previous space key. Changing a space's category requires the Administer Jira global permission.
Step 7 of 9
Space admins can archive or trash team-managed spaces only. Jira and site admins can archive and restore both space types. Moving a space to trash needs Administer Jira or Administer Spaces. Restoring from trash or deleting from it needs Administer Jira.
Exam trap Administer Spaces is not enough to restore a space from trash. Restoring and permanently deleting both need Administer Jira.
Step 8 of 9
An admin can grant themselves app access while creating a space. With a template for an app you cannot access, a checkbox appears. Ticking it adds you to the app's default group, and you count toward that license.
Step 9 of 9
A space admin holds Administer Spaces, but not necessarily Administer Jira.
Space admins can view, but not select or edit, their space's schemes.
Only organization, site and Jira admins can edit or delete a space key.
Restoring or permanently deleting a space in trash needs Administer Jira.
Think first Which global permission would you grant, and to which group, for each site-wide task?
Why it matters: Questions describe a site-wide task a user cannot do and ask which global permission, granted to which group, fixes it.
Global permissions cover actions across the whole Jira site, not one space. You grant them to groups, so membership decides who holds them. Some, such as Make bulk changes, still need the matching space permissions too.
Step 2 of 8
Term
Meaning
Global permission
A permission that applies across the entire Jira site rather than to one space.
Group
A set of users who need the same permissions or restrictions.
Jira admin
Any user who holds the Administer Jira global permission.
Anyone
A grantee option that lets every user who accesses the site perform the action.
Step 3 of 8
Grant global permissions from the Global permissions page. Open Settings, then System, then Global permissions. Use the Grant Permission section at the bottom, pick a group or user, and select Add. To revoke, select Delete under the group name.
Exam trap Choosing Anyone does not keep a permission inside one group. Any user who accesses your site can then perform the related action.
Step 4 of 8
Learn each global permission together with its limit. Each row pairs what a permission lets users do with the condition or limit that comes with it.
Common global permissions and their limits
Permission
Lets users
Watch out
Administer Jira
Create any space and edit schemes for fields, permissions and notifications
Cannot manage or add users, import or export data, or edit system email settings
Create team-managed spaces
Create team-managed spaces
Company-managed spaces need Administer Jira
Make bulk changes
Edit, move, delete or transition many work items at once
Still needs the matching space permissions
Browse users and groups
See all user names in user pickers and @mentions
Without it, only users with Browse spaces in that space show
Share dashboards and filters
Share dashboards and filters with other users
Only when they have permission to view them
Manage group filter subscriptions
Create and delete group filter subscriptions
Covers group subscriptions, not sharing
Step 5 of 8
Org and site admins must join jira-administrators to get Administer Jira. Holding Administer Jira also lets a user log in at any time, regardless of access restrictions.
Exam trap Administer Jira is not full user administration. It cannot manage existing users, add new users, or import and export data.
Step 6 of 8
Empty user pickers point to a missing Browse users and groups. Withholding this permission is also a common way to limit information when you share spaces widely. Users then see only people with Browse spaces in the space they view.
Step 7 of 8
Guests receive no global permissions in Jira. A guest is an external stakeholder who collaborates for free, with limited access to a single space. Guests are free up to 5 per paid user. Paid users and guests together cannot exceed the site's user limit.
Step 8 of 8
Global permissions apply site-wide and are granted to groups.
Create team-managed spaces allows team-managed spaces only; company-managed spaces need Administer Jira.
Administer Jira cannot manage users, import or export data, or edit system email settings.
Empty user picker fields are fixed by granting Browse users and groups.
Think first How does controlling who can do what differ between a team-managed space and a company-managed space?
Why it matters: Questions describe who needs access to a space and ask which access level, role, group or permission setting gives it.
Team-managed spaces control access on their own Access page, through an access level plus roles unique to the space. Company-managed spaces use a permission scheme, and only a Jira admin can update it.
Step 2 of 10
Term
Meaning
Team-managed space
A space whose configuration, roles and custom fields are its own, never shared with other spaces.
Access level
A team-managed setting (Open, Limited or Private) that decides what everyone on the site can do.
Space role
A named set of permissions, unique to one team-managed space, given to people or groups.
Permission scheme
The set of permissions that controls access to a company-managed space.
Global permission
A site-wide permission, such as Administer Jira or Create team-managed spaces.
Step 3 of 10
Team-managed spaces use roles; company-managed spaces use permission schemes. Administration is the main thing that sets the two types apart. A team-managed space keeps its configuration to itself, so a change there never affects another space.
Team-managed and company-managed access compared
Feature
Team-managed
Company-managed
Where access is set
Roles on the space's Access page
A permission scheme
Configuration
Not shared with any other space
Can be shared with other spaces
Custom fields
Bound to that one space
Usually shared across many spaces
Exam trap Looking for a permission scheme in a team-managed space is a common slip. Its access lives on the Access page, as roles unique to that space.
Step 4 of 10
The access level decides what everyone on the site can do. Roles you assign then add permissions on top of it. They never override the access level, and one person can hold several roles.
What each access level gives people on the site
Feature
Open
Limited
Private
What site users can do
View, create and edit work items
View and comment, but not edit or create
Nothing; they can't even see the space
Role behind it
Member
Viewer
Access only for Jira admins and people you add
Exam trap Giving someone the Viewer role in an Open space does not restrict them. Assigned roles add to the Member role they already inherit from the access level.
Step 5 of 10
Administrator, Member and Viewer come with every team-managed space. You can't edit or delete them, but you can duplicate one as a starting point for a new role. Some permissions also need app access to Jira, and only a site admin grants it.
Member and Viewer compared
Feature
Member
Viewer
What they can do
Create, edit, comment on and transition work items
Search and view work items, and little else
App access
Needed to get the full benefit of the role
Not needed; any registered user can have it
Exam trap Need a narrower version of a default role? Editing it is not possible, so duplicate it and build the new role from the copy.
Step 6 of 10
A role can go to individual people or to whole groups. A site-wide group that holds a role gives access to all of its members. On a site's default Jira group, jira-users-{site}, every member gets the users project role. That role sees issues not protected by a security level and can create issues.
Exam trap Removing a person from the Access page does not always end their access. Check with your Jira admin that no site-wide group still grants it.
Step 7 of 10
Jira admins can always reach a team-managed space's settings. A Jira admin is anyone with the Administer Jira global permission. Space names are always visible to them, so keep confidential terms out of names. In company-managed spaces, only a Jira admin can update the permission scheme.
Exam trap Private does not hide a space from Jira admins. It limits the space to Jira admins and the people or agents you add.
Step 8 of 10
A global permission decides who may create team-managed spaces. Out of the box, a software space gives end users the Create team-managed spaces global permission. So by default, anyone with Jira product access can create a team-managed software space. Jira admins restrict it by choosing which groups are granted that permission.
Exam trap Roles are not editable on every plan. On the Free plan you can't edit space permissions or roles, and no Free plan allows work-level security.
Step 9 of 10
A workflow rule can check a permission before a transition runs. Require Create work items to move from Start to To do, and Close work items to move from In progress to Done. Require Assign work items to move from To do to In progress. Adding or removing these rules needs the Administrator role and the Administer spaces permission.
Exam trap Take care when a transition rule limits moves to one role. If you remove that role, your team may have trouble moving work items through the workflow.
Step 10 of 10
Team-managed access is set on the Access page; company-managed access comes from a permission scheme.
Open gives site users the Member role, Limited gives the Viewer role, and Private hides the space from them.
Assigned roles add to the access level's role and never override it.
Default roles can't be edited or deleted, only duplicated into new roles.
After removing a person, check that no site-wide group with a role still grants them access.
Think first How would you keep sensitive work in a team-managed space visible only to the people who need it?
Why it matters: Questions describe sensitive work and ask how to limit who can see it, and what happens when roles change.
Jira access works in layers, from the whole organization down to a single work item. In a team-managed space, one of these layers lets you restrict a type of work so only chosen roles can see it.
Step 2 of 9
Term
Meaning
Space role
A role unique to one team-managed space. You assign people and groups to it to control their access.
Access level
The general access and role that anyone logged in to the site gets in a team-managed space.
Work type restriction
A team-managed setting that lets only chosen roles see new work items of one type.
Restrict any work item
A permission that lets a role change one work item's restriction while viewing it.
Step 3 of 9
Admins own access at organization, product, space and work item level. Exam questions often turn on how these layers depend on each other. Think of product access, global permissions, space permissions, workflow conditions and work item security together.
Step 4 of 9
The Access page holds every permission for a team-managed space. The access level gives every logged-in site user a general role. Roles you add on the Access page grant extra permissions on top of that level; they never replace it. Jira admins can always reach the space's settings.
Exam trap Removing a person from the space may not end their access. They can still get in through a site-wide group that holds a role there.
Step 5 of 9
Restrict a work type when the work holds sensitive data. Some teams handle personally identifiable information (PII) or sensitive financial data. A restriction limits that type of work to specific roles in the space.
Step 6 of 9
Space settings, then Work types, then the lock icon. Select the work type and choose the lock icon at its top-right. From the dropdown, pick the roles that can view new work items of that type by default. You need the Administrator role with the Administer spaces permission.
Exam trap Restrictions are not an option on the Free plan. Work-level security cannot be configured on any Free plan either.
Step 7 of 9
A restriction covers only work items created after it is set. Work items that existed before the restriction keep their old visibility. Roles with the Restrict any work item permission can still change one work item's restriction while viewing it.
Exam trap Adding a restriction does not lock the work items already in the space. Only work created afterward is restricted.
Step 8 of 9
Work locked to a single deleted role becomes inaccessible. If work is restricted to a set of roles, the other roles keep access when one role is deleted. If work is restricted only to a custom role such as Developer, deleting that role leaves nobody able to open it.
Exam trap Deleting a role does not hand its restricted work back to everyone. With a single custom role, the work becomes inaccessible.
Step 9 of 9
A work type restriction applies only to work items created after you set it.
Work restricted to one custom role becomes inaccessible if that role is deleted.
Work items cannot be restricted on the Free plan.
Roles from the Access page add to the access level; they never override it.
Each topic's Check tested it on its own; this mixes them.
Mixed quiz
Take the Domain 1 quiz
17 questions mixed from every topic in this domain, each answer explained. Mixing topics is harder than one at a time, and it is what the exam does. No account needed; with a free account your answers also build your estimated exam score.
Free to start: the study path, quizzes, flashcards and the first mock exam, no card needed. A free account keeps your place and saves your quiz scores.
