Documentation — Group Audit for Jira
1. Setup
- Install Group Audit for Jira from the Atlassian Marketplace (as a Jira admin: Apps → Explore more apps, search for “Group Audit”, then Install; or use the “Try it free” button on the listing).
- Open it under Jira Settings (⚙) → Apps → Group Audit. The page is visible to Jira administrators only, and the app additionally verifies the ADMINISTER permission on every request.
- No configuration is needed. The app stores nothing and writes nothing.
2. Running a scan
- Start typing a group name and pick the group from the suggestion list (keyboard: arrow keys + Enter).
- Click Scan usages. A checklist shows each area being scanned. Large sites are scanned in resumable chunks; hundreds of projects or thousands of filters are fine — the scan just takes longer.
- Read the summary (“N usages in M places · affects P projects”), the result table, and — always — the coverage notes at the bottom.
What is scanned
- Permission schemes — the group as a permission holder, attributed to the projects using the scheme
- Notification schemes — the group as a notification recipient (group-custom-field notifications are flagged “Manual check required” instead of guessed)
- Project roles — the group as a role actor in every project, plus default role actors for future projects
- Issue security schemes — the group as a security-level member
- Filters — sharing and editing grants (all filters, via admin override), JQL that references the group via
membersOf(…), and filter subscriptions emailed to the group - Dashboards — sharing and editing grants, as visible to your account (see coverage notes below)
- Product access — application-role access groups, incl. the default-for-new-users flag
- Group members — total, active and deactivated member counts for context
What is not scanned (coverage notes)
Every report discloses its limits — in the UI and in the CSV:
- Workflow conditions and board/sprint permissions
- Comment and worklog visibility restrictions
- Values of group-picker custom fields on issues
- Automation rule conditions
- Archived projects and archived dashboards
- Global permission grants (Jira Cloud exposes no API for their grantees)
- Issue security schemes of team-managed projects (the Jira API only exposes members for company-managed schemes; affected schemes are named in a coverage note when present)
- Projects whose app access has been revoked (cannot be scanned for roles)
- Dashboards: Jira’s dashboard search has no admin override, so it returns only dashboards visible to your account. If you are a member of the audited group, that covers everything shared with it; if not, the report says so in a coverage note.
- Filter subscriptions: subscriptions are per-user schedules and are checked as visible to your account — subscriptions created by other users may not be visible to you. Every report says so in a coverage note.
3. CSV export
Download CSV saves the full report; Copy CSV puts it on the clipboard. The file is UTF-8 with BOM (opens correctly in Excel, Google Sheets and Numbers). Values that could be interpreted as spreadsheet formulas are prefixed with an apostrophe on purpose (formula-injection protection).
| Column | Meaning |
|---|---|
| Surface | Where the group is used (e.g. “Permission scheme”, “Filter JQL”) — plus the special rows “Manual check required”, “Scan error” and “Coverage note” |
| Location | The scheme, project, filter or dashboard name |
| Detail | The specific grant, event, role or note |
| Projects | Affected projects; “unknown (lookup failed)” or “(list may be incomplete)” when attribution data could not be fully read — never silently empty |
| Link | Deep link to the place in Jira (or admin.atlassian.com for product access) |
| Group / Group ID | The audited group (audit metadata on every row) |
| Scanned at (UTC) | ISO timestamp of the scan |
| Site | Your Jira site URL |
| Scan status | Complete (see coverage notes) — every report carries at least the standing coverage notes — or INCOMPLETE — n checks failed |
If any check failed, the filename carries an -INCOMPLETE suffix and
each failure appears as a “Scan error” row.
4. Permissions & security
- All scopes are granular read-only scopes — deliberately not the broad “Administer Jira” permission. The app cannot change or delete anything.
- No storage, no egress, no analytics: the app runs entirely on Atlassian infrastructure (Runs on Atlassian) and your data never leaves your instance. Details: privacy policy.
- Every request is additionally checked server-side for the caller’s ADMINISTER permission and (for paid installs) an active license.
5. Troubleshooting
“Incomplete scan” banner
One or more checks could not finish — usually Jira rate limiting on very large instances or a transient Jira error. The failed checks are listed in the banner and as “Scan error” rows in the CSV. Fix: run the scan again (off-peak hours help on big sites). Never act on an incomplete report alone.
“Could not verify permissions”
Jira was temporarily unavailable while checking your admin permission. Retry in a moment.
“No active license”
The trial or subscription is inactive. A Jira admin can manage it under Apps → Manage apps.
“The site URL could not be determined”
Reload the page. Result links and the CSV link column need the site URL; everything else works without it.
Scan is slow on a large site
The app scans sequentially with rate-limit-aware backoff on purpose, so it never degrades your instance. Hundreds of projects can take a few minutes — the progress checklist shows where it is.
Contact
Anything unclear or broken? Support page · kontakt@arbeitstyp.de