Troubleshooting

Specific problems, what they mean, and what to do about them. If your problem is not listed here, see FAQ.md, or send a support report from the Diagnostics tab to mira.maty@web.de.

I don't see the app in Jira settings

Check that Access Auditor is installed on the site you are looking at — installation is per-site. Go to Settings → Apps → Manage your apps and confirm it is listed and enabled. If it is not there, it has not been installed on this site, or your Atlassian organisation administrator has restricted which apps can be installed; ask them to install it.

"You need the Jira administrator permission to use Access Auditor" (MAA-E401)

Every screen checks, on every request, whether you hold the Jira Administer Jira global permission — using your own Jira credentials, not the app's. If you do not hold it, you see this message instead of data. This is not an app-level restriction; it is Jira's own permission model. Ask a site administrator to either run the audit for you or grant you Administer Jira.

"Access Auditor is not licensed on this site" (MAA-L001)

The app's Marketplace licence is not active — most often an expired trial or an expired or cancelled subscription. Start a trial or subscribe from the app's Atlassian Marketplace listing, then reload the page.

"A scan is already running" (MAA-E403)

Access Auditor runs one scan at a time. If a scheduled scan is already in progress and you select Run scan now, you will see this message. Wait for the current scan to finish — check its progress on the Overview tab — then start another one. A scan that appears stuck for longer than about 20 minutes is treated as stale by the app itself and will not block a new scan indefinitely.

Rate limiting (MAA-E429)

Jira Cloud rate-limits API traffic on every site. A scan that hits a rate limit retries automatically, honouring Jira's own retry-after guidance, so an occasional rate-limit response during a scan is expected and usually invisible to you. If rate limiting is severe enough that a scan cannot finish, it is marked incomplete or failed and the failure surfaces as described below. This is more likely on a very large site; consider narrowing scope with the exclusion lists on the Settings tab if it recurs.

An unexpected error (MAA-E500)

A general failure that does not fall into the above categories — either an unexpected condition during a scan, or an error a screen could not otherwise classify. Reload the page and try again. If it persists, open Diagnostics, select Copy diagnostic report, and send it to mira.maty@web.de along with what you were doing when it happened.

A scan is marked incomplete

The Overview tab shows a warning banner when the last scan could not read everything it needed to. This happens when a Jira capability the scan depends on came back degraded or forbidden, or when a site-wide collection cap was reached (see Known_Limitations.md for the exact caps). The banner tells you which part was affected. Findings and the permission matrix from an incomplete scan are still shown; treat the affected area as under-reported until the next successful, complete scan.

A capability is shown as degraded or forbidden

On the Diagnostics tab, each Jira capability the scan depends on is marked ok, degraded or forbidden. A degraded or forbidden capability usually means your site restricts that data even from an app with the matching scope granted — for example, some sites restrict who can see shared filters and dashboards beyond their owner. When this happens the app records it rather than silently showing fewer results. Use run an on-demand capability check on Diagnostics to re-test without waiting for the next scheduled scan.

"Jira answered 403 for some projects"

Since version 3.2.0 you normally do not need to do anything: the app completes the audit of those projects itself, with your administrator access.

Why it happens. Reading a project's permission scheme, its issue security scheme and its role members requires the Administer Jira global permission or the Administer projects permission in that project. Access Auditor reads as its own app account, so it needs Administer projects in each project's permission scheme. On Atlassian's default schemes that permission is granted to the atlassian-addons-project-access project role, which installed apps belong to. A project that uses a custom permission scheme without that grant answers 403 to the app.

What the app does about it. You hold Administer Jira - every screen of the app checks that - and that is enough for these reads. So when you open the Overview or select Run scan now, the app reads the projects Jira refused to it with your own access, and a fresh scan then audits them in full. The Overview says so while that scan runs. Scheduled scans, which run with nobody signed in, reuse that read; the Explorer shows on each such project when it was read. Nothing is written to Jira.

If the warning stays. The banner then names the projects and the reason. Either Jira refused your account as well, or more than fifteen projects were refused and the rest are read on your next visit. To let the app read those projects directly, also in scheduled scans, open Settings → Issues → Permission schemes in Jira (on your site: /jira/settings/issues/permission-schemes), open the scheme the named project uses, and grant Administer projects to the project role atlassian-addons-project-access. Then select Run scan now on the Overview tab. The permission only lets the app read that project's configuration.

My team-managed project shows no permissions

This is expected, not an error. Team-managed (next-gen) projects control access inside the project itself rather than through a permission scheme, and that access model is not exposed the same way scheme-based access is. Access Auditor lists these projects and labels them clearly, but shows no permission matrix and raises no findings for them. Company-managed projects are fully covered. See Known_Limitations.md.

A group shows no members

Two possible reasons. First, group membership is only collected for groups that actually carry access — a group referenced by a permission grant, a project role, a shared filter or an application role. An unrelated group is never queried for members, by design, to keep both the scan and your data footprint smaller. Second, on a very large site a group's member list can be truncated by the per-group collection cap; the member count shown still reflects Jira's own total for the group even when the list is capped.

The export did not download

The app runs inside a Forge iframe inside Jira, and some browsers or browser extensions block a file download initiated from inside an iframe. If Download does not produce a file, use the Copy to clipboard option next to it instead, and paste the CSV or JSON into a file yourself.

How to send a useful support report

Open the Diagnostics tab.
Select Copy diagnostic report. This report is built to contain no

personal data and no credentials — no project name, group name, account identifier or permission holder appears in it.

Paste the report into an email to mira.maty@web.de, along with a short

description of what you expected and what happened instead.