What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Atlassian Data Center does not use one universal file permission. In Jira, attachment uploads and deletion are controlled through project permissions, while access to an issue can be narrowed with issue security. In Confluence, files are attachments to pages or blog posts: users generally need access to the containing page to see its attachment link, and space permissions control uploading and deletion. Start by identifying the product and the operation—view, upload, or delete—then check the relevant layer.
How Jira and Confluence file access differs
| Question | Jira Data Center | Confluence Data Center |
|---|---|---|
| Where is upload permission assigned? | Through the project’s permission scheme; grant Create attachments. | Through space permissions; grant Add Attachment. |
| What controls whether a user can see a file? | Access to the project and issue, including any issue security level applied to that issue. | Access to the page or blog post containing the attachment, subject to global, space, and page access. |
| How is deletion controlled? | Grant Delete own attachments if users should delete their own issue attachments. | Grant Delete Attachment in the space for attachment removal. |
| How are permissions assigned? | Project permissions are assigned in a permission scheme to users, groups, or roles. Jira also has global permissions, distinct from project permissions. | Global “Can Use,” space permissions, and page restrictions work at different scopes. Evaluate individual and group grants together. |
| Do file-type controls affect existing files? | Extension allowlists and blocklists affect uploads made after configuration; they do not validate files already attached. | The cited controls govern access and attachment actions; no retroactive file-validation behavior is stated in the cited guidance. |
These layers are not interchangeable. A user may be allowed into an application but lack access to a project or space; they may have project or space access but still be blocked from a particular issue or page. Atlassian defines a Jira permission scheme as “a set of assignments between project permission and a user, group, or role” in its Jira Data Center 11.3 documentation.
As an Amazon Associate I earn from qualifying purchases.
How to control Jira issue attachments
Allow uploads and deletion
For the relevant project, open the permission scheme and grant Create attachments to the users, groups, or roles that should upload files. To let users remove their own issue attachments, grant Delete own attachments as well. These are project permissions, so check the scheme applied to the specific project rather than assuming an application-wide grant is sufficient.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallIf uploading an attachment while creating a new issue fails, check the field configuration for that issue type. The Attachment field must not be hidden. Atlassian documents these permission and field checks in its Jira Data Center attachment guide.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Set attachment availability and size
Jira’s global attachment setting is under Jira System → Advanced → Attachments. The Jira Data Center 10.5 guide documents a default maximum of 10 MB per file and a maximum of 2 GB per file. Those figures describe the documented 10.5 settings; administrators should verify the deployed release and any local configuration rather than treating them as universal limits.
Restrict extensions on new uploads
Starting with Jira 9.15, Atlassian documents extension allowlists and blocklists. An allowlist accepts only the listed formats; a blocklist rejects the listed formats while allowing others. The setting can include files without extensions. It applies to files uploaded after the rule is configured and does not validate existing attachments, so it is a forward-looking upload control, not a scan or cleanup of the current file collection. See the Jira attachment configuration documentation for the release-specific setting.
Limit access to Jira’s stored data
Application permissions are only one part of protecting sensitive Jira data. Atlassian advises restricting operating-system access to the directories holding Jira’s index and attachments, and controlling access to the relevant database. The Jira process account still needs the access required to operate on those protected locations. Review the Jira security guidance alongside permission schemes.
Recommended Free Tools
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Know the deployment boundary for S3
The Jira Data Center 10.5 documentation describes optional attachment storage in Amazon S3 for Jira instances running in AWS. It says this feature is not supported for on-premises deployments or customers not running Jira in AWS; it is not a general storage setting for every Jira Data Center installation. See Atlassian’s Amazon S3 object storage documentation.
How to control Confluence attachments
Allow uploads and deletion
Confluence files are attachments to a page or blog post. At the space level, Add Attachment allows uploading and Delete Attachment allows removal. Add Page or Add Blog permission alone does not let someone upload a new file. A user with those content-creation permissions but without Add Attachment may still insert an attachment that already exists. The Confluence space permissions overview also distinguishes deleting one’s own content from deleting content created by others, so verify the exact permission needed for the action.
Control who can see a file
Atlassian’s Confluence Files guide says there is no permission specifically for controlling attachment downloads. That does not make every attachment public: the practical visibility control is access to the page containing the file. The guide states that a visitor who cannot view the page will not see its attachment link rendered. Because this download-permission guidance comes from an older Files guide last modified March 1, 2017, confirm the behavior against the documentation for the deployed release before relying on it for a specific installation.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Apply page restrictions
Page restrictions can limit who may view or edit individual pages, and may be assigned to users or groups. Restrictions can also be inherited by child pages. A page restriction cannot be overridden simply by granting View permission for the space, according to Atlassian’s Confluence access guidance.
To add or remove restrictions, a user needs page edit rights plus Restrict or Admin permission in the space. Space administrators and system administrators can remove page restrictions even if those restrictions prevent them from viewing the page. Atlassian’s Confluence Data Center 10.2 documentation says an access request for a restricted page may contact up to five people; see page restrictions in Confluence Data Center 10.2.
Check global and space access in order
- Confirm “Can Use.” The user must be allowed to use Confluence under the global permission.
- Check space View permission. Verify the user’s effective permission in the relevant space.
- Check the page and its parent restrictions. A page restriction, including an inherited restriction, may block access even when space View is granted.
- Review anonymous or public access. Determine whether anonymous access is enabled and whether it changes who can reach the content.
- Assess individual and group grants together. Confluence space permissions combine grants; inspecting only one group may not reveal the user’s effective access.
Atlassian’s support article reports that cached permission changes may take up to five minutes to propagate across Confluence Data Center cluster nodes. Removing a user from a group may also leave permissions in the user’s session until the next login or a session-cache refresh. Treat this as reported behavior, not a guaranteed timing limit, and check the deployed version and authentication setup. See Atlassian Support’s permission-change guidance.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Why can someone see a Confluence space but not a page or file?
- Global access: Confirm the user has Can Use permission.
- Space access: Check effective View permission, including both individual and group grants.
- Page-level access: Inspect restrictions on the page and any inherited from a parent. Space View does not override a page restriction.
- Attachment visibility: Confirm the user can view the page or blog post that contains the attachment.
- Permission propagation: If access was just changed, account for reported cache and session behavior before diagnosing a persistent fault.
For an unclear effective grant, use Inspect permissions in Confluence Data Center. Atlassian describes it as useful for troubleshooting and auditing; the feature is covered in Confluence Data Center 9.4 documentation.
Why can a Jira user not upload an attachment?
- Confirm attachments are enabled in Jira System → Advanced → Attachments.
- Check that the permission scheme for the project grants Create attachments to the user through an applicable user, group, or role.
- If the upload is part of issue creation, verify that the Attachment field is visible in the field configuration for that issue type.
- Check the configured file-size limit and, on Jira 9.15 or later, any extension allowlist or blocklist.
For deletion, confirm the applicable attachment-deletion permission rather than assuming upload permission also allows removal.
Quick Recap
What administrators should audit
- In Jira, review global permissions separately from each project’s permission scheme, and review issue security where visibility must be narrower than project access.
- In Confluence, assess Can Use, space permissions, page restrictions, and anonymous access in sequence; include inherited restrictions and group membership.
- For both products, distinguish viewing from uploading and deleting. Similar labels do not mean the products use the same permission system.
- For sensitive Jira deployments, review filesystem permissions on the index and attachment locations and access to the database, while preserving required Jira service-account access.
- Record the deployed product version and relevant configuration when reviewing numeric limits or release-sensitive behavior.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
