Getting Started

Copyright 2026 Matify. All Rights Reserved.

This page takes you from installing Access Auditor for Jira to acting on your first finding. Every step happens in your browser, in Jira itself. Nothing here needs a developer tool, a command line, or a demo site.

Before you start

You need the Jira Administer Jira global permission on the site you install into. Access Auditor checks this on every request, using your own Jira credentials, before it shows you anything.

Steps

1. Install Access Auditor for Jira from the Atlassian Marketplace onto

your Jira Cloud site, or ask your Atlassian organisation administrator to install it for you.

1. Open the app. In Jira, go to **Settings (the gear icon) → Apps →

Access Auditor**.

1. Check the first scan. A first scan is queued automatically as soon

as the app is installed. If it has already finished, the Overview tab shows its results. If it is still running, you will see progress on screen. If for any reason no scan has started, select Run scan now on the Overview tab.

1. Read the Overview tab. It shows your open findings grouped by

severity (critical, high, medium, low, info), when the last scan ran, how long it took, and whether it was able to read everything it needed to. If a warning banner appears saying the scan is incomplete, see Troubleshooting.md.

1. Open the highest-severity finding. From the Overview tab's list of

top findings, or from the Findings tab sorted by severity, open the first critical or high finding.

1. Read the finding. Each one has a plain-language summary, a

suggested remediation, a list of evidence that shows how the app reached its conclusion, and — where Jira supports it — a link straight into the relevant Jira administration screen.

1. Act on it. Two options, and they are not exclusive:

• Follow the deep link into Jira and change the permission scheme,

project role or share setting directly in Jira.

• Or, from the finding, mark it acknowledged or resolved, with

an optional note explaining the decision. This keeps a record inside Access Auditor even if you decide the configuration is intentional.

1. Look around the other tabs when you have time. The

User_Guide.md explains each of the eight tabs — Overview, Findings, Explorer, Schemes, Changes, Exports, Settings and Diagnostics — in detail.

1. Adjust Settings if the defaults don't suit your site. Scan

frequency, the sensitivity profile, the large-group threshold, history retention and exclusion lists are all on the Settings tab. The defaults are a daily scan, the standard sensitivity profile and 90 days of retention.

What "first value" looks like

By the end of these steps you have seen your site's open findings ranked by severity, understood why the highest one was raised, and either fixed it in Jira or recorded a decision about it. That is the loop Access Auditor is built around, and it repeats on every scan.

Next

• User_Guide.md for a full tour of every tab.
• Permissions_and_Security.md if you need to

explain to your security team why the app asked for the scopes it did.

• Troubleshooting.md if something above did not go as

described.