Access Auditor for Jira
Copyright 2026 Matify. All Rights Reserved.
Access Auditor for Jira answers one question for a Jira Cloud administrator: who can access what, and why. It scans your site's permission schemes, project roles, groups and shared filters and dashboards, resolves each grant down to the people and groups who actually hold it, and reports the configurations most likely to be a risk. It then tracks what changes between scans, so an access review is a comparison, not a re-investigation from scratch.
Who this is for
A Jira Cloud site administrator who holds the Administer Jira global permission and is responsible for answering "who has access to this project", preparing for an access review, or noticing when a permission scheme has quietly drifted.
What it does
- Scans permission schemes, project roles, groups, shared filters and shared
dashboards, and resolves each grant to the people and groups who hold it.
- Raises twelve findings covering anonymous access, over-broad grants,
stale accounts, oversized administrator groups, duplicate schemes and more. See User_Guide.md for the full list.
- Lets you acknowledge, resolve or reopen a finding, with a note, so a
reviewed item stays reviewed across scans.
- Shows what changed since the previous scan.
- Exports findings, the permission matrix and the change list as CSV or
JSON.
- Runs entirely inside Atlassian's infrastructure as a Forge app. It reads
Jira configuration and writes nothing back to Jira. See Permissions_and_Security.md and Privacy_and_Data.md.
What it does not do
- It does not list your Jira site administrators. Jira Cloud's API
exposes no endpoint for global permission grants, so this cannot be read directly by any app. Access Auditor instead marks a group as privileged on three verifiable signals and always tells you which one applied. Details in Known_Limitations.md.
- It does not tell you who made a change or exactly when. The Changes
tab reports what differs between two scans, not who did it, because that would require reading Jira's audit log, which this app does not request.
- It does not cover team-managed (next-gen) projects' own access model.
These projects are listed and labelled but carry no permission matrix and raise no findings.
- It is not a compliance guarantee. It reports what the Jira Cloud REST API
exposes; see Known_Limitations.md for the exact boundaries before you rely on it for an audit.
- It makes no changes to Jira. Every declared scope is read-only.
Where to start
| Document | Read this for |
|---|---|
| Getting_Started.md | Installing the app and reaching your first finding |
| User_Guide.md | What each of the eight tabs shows and how to read it |
| Permissions_and_Security.md | Why the app needs Administer Jira, and what every declared scope is for |
| Privacy_and_Data.md | What is read, what is stored, for how long, and how to remove it |
| Known_Limitations.md | The real boundaries of what the Jira Cloud API exposes |
| Troubleshooting.md | Specific errors and what to do about them |
| FAQ.md | Common buyer and administrator questions |
| CHANGELOG.md | Release history |
Support
mira.maty@web.de