User Management, Groups, and Permissions
What to know
Understand the difference between users, groups, and project roles. Users are accounts; groups are global collections used for global permissions and license management; project roles are per-project and are the recommended way to grant project permissions. Permission schemes grant permissions to users, groups, roles, or the reporter/assignee. Global permissions (e.g., Jira Administrators, Create Shared Objects, Browse Users) are separate from project permissions. Application access controls which products a user may use (Jira Software vs. Jira Service Management). Authentication can come from internal directories or external ones such as LDAP or SAML.
Traps
Questions often test that a user with a project permission cannot act globally, and vice versa. Remember that project roles cannot be used in global permissions. Another trap: "Browse Projects" is required before any other project permission matters. Also watch for group membership inheritance and whether a permission is granted to "Anyone" versus "Logged in users."
Rule of thumb
Grant project access through roles, not individual users, and reserve groups for global permissions and licensing. When a user cannot see a project, check Browse Projects first, then role membership, then application access.
Worked example
A new hire can log in but sees no projects. Check: does the account have Jira application access? Is the user in a group or role granted Browse Projects on the target project? Fix by adding the user to the project role that the permission scheme grants Browse Projects.