Since 2009
TELCOMA Global / Group & Permission Usage for Jira / Documentation
Where groups are used, and who can browse each project.
Group & Permission Usage builds a report of every group and every live project on your Jira Cloud site: what each group grants, which projects each person can browse, and why. The app only reads. It has no permission to change anything.
Install
Two steps, both inside Jira.
Find the app
In Jira go to Settings → Apps → Find new apps and search for Group & Permission Usage. It's free for every site size.
Approve the permissions
Read permissions only. There is no write permission, so the app cannot change anything on your site.
Jira administrators open the app under Settings → Apps → Group & Permission Usage. Nobody else can see it.
Build a report
One button. It runs in the background.
Click Build a report on the Overview tab. The app reads, in order: which groups grant product access, every group and its members, every live project with its permission scheme and role members, every permission scheme, shared filters and dashboards, and issue security and notification schemes. A progress line shows the step it's on. You can leave the page; the report carries on.
The Overview tab then shows the totals: how many groups (empty, with no use found, granting product access), how many projects (open to the public, open to any licensed user, team-managed), how many shared filters and dashboards, and how many schemes.
If a report stops making progress for 20 minutes, the page offers a restart. Restarting is safe, because a report changes nothing.
Groups
Every group, what it grants and where it's used.
- Each row shows the group, its members, the products it grants and a short Used in summary, such as 1 permission scheme · 4 security levels.
- Details lists every use: product access, permission scheme grants, project roles (project and role), shared filters and dashboards, issue security levels and notification schemes.
- Empty marks groups with no members. No use found marks groups that nothing the app can read refers to. Both are good candidates for clean-up, after you check the places the app can't see (below).
- Filters: search by name, and show all groups, empty groups, groups with no use found, or groups that grant product access. Click a column header to sort.
Projects
Who each project's permission scheme lets in.
- Each row shows the project, its type, its permission scheme and who Browse projects is granted to, for example Any licensed user · 4 roles.
- Who can access lists the people in the report who can browse the project, and the reason for each: the group, the project role (and the group behind it), a direct grant, the project lead, or "any logged-in user".
- Projects open to the public and projects open to any licensed user are flagged, because those are the ones auditors ask about first.
- Filters: search by key or name, and show all projects, those browsable by the public, those browsable by any licensed user, those not open to everyone, or team-managed projects.
"Any logged-in user" is counted as everyone in a group that grants a Jira product.
Lookup
What one person can reach.
Type a name or email, pick the person, and the app shows their groups, the products those groups grant, and every project they can browse with the reason. Useful when someone changes team or leaves, and you want to know what they still have.
Someone who was in no group when the report was built is still looked up; only roles, direct grants and public projects count for them.
Export and past reports
Take it to Excel, or go back to an older report.
Download Excel
One workbook: Summary, Groups, Projects, Scheme grants, Shared filters, Shared dashboards, Security levels and Notifications. Built in your browser.
Download groups CSV
The Groups sheet as a plain file, for tools that don't open Excel.
Past reports
The last 6 reports are kept. Open one to see it in the other tabs, or delete it.
Safe files
Cells that a spreadsheet would read as a formula are written as plain text, so a group or filter name can never run anything.
What it can't see
Some places Jira doesn't show to apps.
- Global permissions, workflow conditions and board administrators. Jira Cloud has no API for these. A group used only there shows as No use found, so check them before you delete a group.
- Dashboards. Only dashboards the app itself can see: shared with the public, with a public project, or with a group the app is in. The report says so.
- Archived projects are not listed.
- Bots and portal customers are left out of group members, because they hold no seat.
Your data
Nothing leaves Atlassian.
Groups and members, product access, projects, permission schemes, project roles, shared filters and dashboards (who they are shared with, not their contents), and issue security and notification schemes. It does not read issues, comments or attachments.
Nothing. The app has no write permission.
Each report's groups, projects, grants and memberships, with people as account IDs only. Names and emails are looked up from Jira when a page is shown. The last 6 reports are kept, in Atlassian's own storage for your site.
Nowhere. No servers of our own, no requests outside Atlassian. Exports are built in your browser and saved to your device.
Full details in the privacy policy.
Frequently asked
The questions admins ask first.
Is it really free?
Yes, for every site size. There is no paid plan and no trial.
Can I delete a group the app says isn't used?
Check global permissions, workflows and boards first; the app can't see those. If the group isn't there either, it's safe to remove in Atlassian Administration.
Does it change permissions?
No. It has no write permission. Every change stays with you, in Jira.
How often should I build a report?
Whenever you need a current picture: before a clean-up, after a reorganisation, or ahead of an audit. Each report is a snapshot of the moment it was built.
Does it cover Confluence?
No, Jira only. Groups are shared across Atlassian products, so a group used only in Confluence may show as No use found here.
How does it relate to Access Review?
Access Review is for signed-off, quarterly reviews of who has access. Group & Permission Usage explains why people have access, and where each group is used.
Support
Ask the people who built it.
When reporting a problem, include your site URL and what you expected to happen. We never need passwords or tokens.
Get help
One business day, usually much less.
- [email protected]
- Support page
- Known limits, what to include, status
- Response time
- Within one business day