Native Jira anonymous access
Jira's own anonymous access makes a whole space readable by anyone on the internet. This page explains what that exposes, and how a public link from External Share & Public Links differs.
How anonymous access works
A Jira admin turns on anonymous access for a space by letting anonymous users browse the space in its permission scheme. From then on, anyone with the address can:
- open every work item in the space, with its comments, attachments, work log and history;
- search the space, and follow links to work items in other spaces they can reach;
- open filters and dashboards shared publicly.
It suits sites that are meant to be public, such as an open-source project's issue tracker. It's built for whole spaces, not for sharing a few work items with a client.
Security risks
- Everything in the space is public. You can't make one work item public and keep the next one private. New work items are public the moment they're created.
- No way to cut off one person. Access lasts until an admin changes the permission scheme, and it ends for everyone at once.
- No expiry and no password. Nothing stops working on its own, and nothing asks who is reading.
- Often forgotten. People create work items without noticing that the space is public, and a later change to a shared permission scheme can open more spaces than intended.
- Personal data becomes public. Names, email addresses in comments and customer details are readable by anyone, which can conflict with your privacy obligations.
How the app differs
| Topic | Jira anonymous access | External Share & Public Links |
|---|---|---|
| What becomes public | Every work item in the space | Only the work item, board or filter you share, and only the sections you switch on |
| Who can open it | Anyone, through any Jira address | Only people with the link's unique URL |
| Password | Not supported | Optional, per link |
| Expiry | Not supported | Optional, per link, with a site-wide maximum |
| Stopping access | Change the permission scheme for everyone | Turn off one link, or replace its URL |
| Overview for admins | None | Every link on the site, with an audit log and open counts |
| Viewers need a Jira account | No | No |
When to use which
- Use Jira's anonymous access when the whole space is meant to be public and stay public.
- Use a public link when you want to show specific work to specific people, for a limited time.
Related
- Data security and privacy: what the app stores and how a shared page reads Jira.
- Sharing policy settings: limit who can share, and which spaces.
- Get started with External Share: install the app and send a first link.