Documentation — Group Audit for Jira
1. Setup
- Install Group Audit for Jira from the Atlassian Marketplace (as a Jira admin: Apps → Explore more apps, search for “Group Audit”, then Install; or use the “Try it free” button on the listing).
- Open it under Jira Settings (⚙) → Apps → Group Audit. The page is visible to Jira administrators only, and every request runs with your own Jira permissions.
- No configuration is needed. The app stores nothing and writes nothing.
2. Looking up a group
- Start typing a group name and pick the group from the suggestion list (keyboard: arrow keys + Enter).
- Click Scan site. Group Audit reads every area listed below once — several requests at a time, with a progress bar and a checklist — and you can cancel at any time. Small sites take seconds, sites with hundreds of projects a few minutes.
- Read the summary (usages, places, projects affected, members), the results by area or by project, and — always — the coverage notes at the bottom.
- After one scan, every other group can be looked up instantly without scanning again. Rescan site refreshes the data.
All groups
The All groups tab lists every group of your site with its usage
count, from the same scan — sortable, filterable and exportable, with optional member
counts. Groups with no usages found are the starting point for a cleanup;
groups created by Atlassian (product access, admin groups) are marked, because they
are usually used in global permissions, which no API exposes. Places that still
reference a group which no longer exists — typically membersOf() in a
filter — are listed separately.
What is scanned
- Permission schemes — the group as a permission holder, attributed to the projects using the scheme
- Notification schemes — the group as a notification recipient, attributed to projects
- Project roles — the group as a role actor in every project, plus default role actors for future projects
- Issue security schemes — the group as a security-level member
- Filters — sharing and editing grants (all filters, via admin override), JQL that references the group via
membersOf(…), and filter subscriptions emailed to the group - Dashboards — sharing and editing grants, as visible to your account (see coverage notes below)
- Product access — application-role access groups, incl. the default-for-new-users flag
- Group members — total, active and deactivated counts, and the full member list (Members tab)
Grants to “the group in a custom field” (permission schemes, notification schemes, issue security levels) are listed under Manual check required — which group that is depends on issue data, so the app never guesses.
What is not scanned (coverage notes)
Every report discloses its limits — in the app and in every export:
- Global permission grants (Jira Cloud exposes no API that lists their holders)
- Automation rules, workflow conditions and validators, and Jira Service Management approval steps that name a group
- Board and sprint permissions, comment and worklog visibility restrictions
- Values of group-picker custom fields on issues
- Archived projects and archived dashboards, JSM organizations and portal access
- Issue security schemes of team-managed projects (the Jira API only exposes members for company-managed schemes; affected schemes are named in a coverage note when present)
- Projects whose app access has been revoked (cannot be scanned for roles)
- Dashboards: Jira’s dashboard search has no admin override, so it returns only dashboards visible to your account. If you are a member of the audited group, that covers everything shared with it; if not, the report says so in a coverage note.
- Filter subscriptions: subscriptions are per-user schedules and are checked as visible to your account — subscriptions created by other users may not be visible to you. Every report says so in a coverage note.
3. Exports
The Export menu of a group report offers Download CSV (audit evidence), Download JSON (for scripts), Copy summary (plain text for a change ticket or an email), Copy CSV and Print or save as PDF. The Members tab exports the member list, the All groups tab the overview. CSV files are UTF-8 with BOM (they open correctly in Excel, Google Sheets and Numbers); values that could be interpreted as spreadsheet formulas are prefixed with an apostrophe on purpose (formula-injection protection).
| Column | Meaning |
|---|---|
| Surface | Where the group is used (e.g. “Permission scheme”, “Filter JQL”) — plus the special rows “Group members”, “Manual check required”, “Scan error” and “Coverage note” |
| Location | The scheme, project, filter or dashboard name |
| Detail | The specific grant, event, role or note |
| Projects | Affected projects; “unknown (lookup failed)” or “(list may be incomplete)” when attribution data could not be fully read — never silently empty |
| Link | Deep link to the place in Jira (or admin.atlassian.com for product access) |
| Group / Group ID | The audited group (audit metadata on every row) |
| Scanned at (UTC) | ISO timestamp of the scan |
| Site | Your Jira site URL |
| Scan status | Complete (see coverage notes) — every report carries at least the standing coverage notes — or INCOMPLETE — n checks failed |
If any check failed, the filename carries an -INCOMPLETE suffix and
each failure appears as a “Scan error” row. If the member count could not be read,
the “Group members” row says so instead of being left out.
4. Permissions & security
- All scopes are granular read-only scopes — deliberately not the broad “Administer Jira” permission. The app cannot change or delete anything.
- No storage, no egress, no analytics: the app runs entirely on Atlassian infrastructure (Runs on Atlassian) and your data never leaves your instance. Details: privacy policy.
- No backend: every Jira request is made from the app page with your
permissions (Forge
requestJira), so the app can never see more than you can, and nothing runs outside your session.
5. Troubleshooting
“Incomplete scan” banner
One or more checks could not finish — usually Jira rate limiting on very large instances or a transient Jira error. The failed checks are listed in the banner and as “Scan error” rows in the CSV. Fix: run the scan again (off-peak hours help on big sites). Never act on an incomplete report alone.
“No active license”
The trial or subscription is inactive. A Jira admin can manage it under Apps → Manage your apps.
“The site address could not be determined”
Reload the page. Result links and the CSV link column need the site address; everything else works without it.
“You need permission to browse users and groups”
The group search uses your own Jira permissions. Jira administrators normally have them; check the Browse users and groups global permission.
Scan takes a while on a large site
The app reads at most eight things at once and backs off whenever Jira asks it to, so it never degrades your instance. Sites with hundreds of projects take a few minutes; the progress bar shows where it is, and you can cancel at any time.
Contact
Anything unclear or broken? Support page · kontakt@arbeitstyp.de