Space Permissions lost after migration from Confluence Server to Confluence Cloud?
Asked by Tommy Lee:

We migrated from Confluence (and Jira) Server to Confluence (and Jira) Cloud a few months ago.

We noticed today that our Org Admins (I being one of them) do not have edit permissions to most of our Space Details in Space Settings. We can still view them, I think, because we're still part of the confluence-users group.  
After digging around in the Default Space Permissions screen, I notice that most of the spaces do not have the "Manage Permissions" option but now have the "Recover Permissions" option.  

Looking at space details of all the spaces we Org Admins cannot access shows an individual user in the Administrators listing. This user was our Server Admin that did the migration from Server to Cloud.  
So we're not sure if it was a configuration error during the migration that did not include the confluence-administrator group transferring its permissions to Confluence Cloud.  

Regardless, question is:  
Is there an automated easy way to add a group (confluence-administrator) to every Space Permission?  
Right now it seems like we need to manually Recover Permissions to each and every space and manually add new group to its permissions. Is this the only way?  

And if we did the migration wrong, what was the correct way we should have done this so that all the Space Permissions carried over as it was?


Answers:
author: Francis Batilo
body: [@Tommy Lee](/t5/user/viewprofilepage/user-id/5369881) ,

Welcome to the Atlassian Community.  

There are a few possible ways to trigger this kind of scenario during migration. I can discuss that in detail if you want but let's first get your access reinstated.

Would you be open to doing a trial of [Confluence Command Line Interface (CLI) \| Atlassian Marketplace](https://marketplace.atlassian.com/apps/284/confluence-command-line-interface-cli?hosting=cloud&tab=overview)?

If you are, I'll give you the script that will run across all your spaces and grant the specific group the appropriate admin access. After that, you can choose to keep the app or remove it.

<br />

Let me know if you're interested.

Cheers,  
Francis

comments: author: Tommy Lee
body: Hi Francis,

I will certainly want to give this cli a try. Let me know what I need to do.

Thanks so much for the help.

-Tommy


author: Francis Batilo
body: Alright. So, if you can follow and install the CLI in your instance and then install the shell client (you can use powershell if you want) by following these instructions.

[Confluence Command Line Interface (CLI) - Appfire (atlassian.net)](https://appfire.atlassian.net/wiki/spaces/CSOAP/overview)

[Installation and Use - Confluence Command Line Interface (CLI) - Appfire (atlassian.net)](https://appfire.atlassian.net/wiki/spaces/CSOAP/pages/68457775/Installation+and+Use)

Once you have that, you can run this from whichever client you're using

--action runFromSpaceList --common "--action addPermissions --space [@space](/t5/user/viewprofilepage/user-id/4882597)@" --group "confluence-users" --permissions "viewspace,editspace,setpagepermissions,removepage,editblog,removeblog,comment,removecomment,createattachment,removeattachment,exportspace""

I hope this helps

Cheers,  
Francis


author: Tommy Lee
body: Am I installing and configuring the ACLI connection first?


author: Francis Batilo
body: [@Tommy Lee](/t5/user/viewprofilepage/user-id/5369881) ,

Yes, that is correct. Here's a step-by-step workflow for this activity.

1. Install CLI for Confluence in your cloud instance
2. Install the client in your PC or use powershell
   1. [CLI Client Installation and Use - Appfire Command Line Interface (CLI) - Appfire (atlassian.net)](https://appfire.atlassian.net/wiki/spaces/ACLI/pages/60560924/CLI+Client+Installation+and+Use)
3. Login with your admin credentials in the client
4. Run the script provided.
5. Verify the results of the command
6. Uninstall the CLI for Confluence.

I hope this helps.

Cheers,

Francis


author: Tommy Lee
body: [@Francis Batilo](/t5/user/viewprofilepage/user-id/4609548)

Do I need to change any of the parameters in the command you sent?  
Is there documentation to the script? It seems to be adding all the permissions to the "confluence-users" group? I'm not sure that's what I want to be doing.  

The screenshot is the permissions on one of the spaces that I recovered permissions on. Notice that I now have mostly full access as an Individual User.  
My previous Atlassian Admin (Mike Eldridge) has Admin access to all the spaces.  
There is no confluence-administrator group that has Admin access, and this is what I'd like to add to all the spaces.

<br />

![image.png](https://community.atlassian.com/t5/image/serverpage/image-id/293126i5DB9A4F3AA5D2F0D/image-size/large?v=v2&px=999 "image.png")


author: Tommy Lee
body: I think I found the documentation:  

<https://appfire.atlassian.net/wiki/spaces/CSOAP/pages/68458373/addPermissions>


author: Tommy Lee
body: [@Francis Batilo](/t5/user/viewprofilepage/user-id/4609548)

I got this error while trying to revise your script command. Thoughts?

![image.png](https://community.atlassian.com/t5/image/serverpage/image-id/293324iDBB87AC708900733/image-size/large?v=v2&px=999 "image.png")


author: Tommy Lee
body: Tried again with extra quotes. Didn't seem to work either.  

![image.png](https://community.atlassian.com/t5/image/serverpage/image-id/293326iA09966328822DDEF/image-size/large?v=v2&px=999 "image.png")


author: Francis Batilo
body: [@Tommy Lee](/t5/user/viewprofilepage/user-id/5369881) ,

Could you update the first action command to have two "-"? So instead of -action it should be --action

Also, if you're using the client provided by the CLI and not powershell, try starting the command with acli --action runFromSpaceList...

I hope this fixes the issue.

Cheers,

Francis


author: Tommy Lee
body: [@Francis Batilo](/t5/user/viewprofilepage/user-id/4609548)   

Hmm, closer. I wonder why I don't have permission.  

![image.png](https://community.atlassian.com/t5/image/serverpage/image-id/293339i9FF60D144832A9FA/image-size/large?v=v2&px=999 "image.png")


author: Francis Batilo
body: [@Tommy Lee](/t5/user/viewprofilepage/user-id/5369881) ,

Take note of the spaces that doesn't allow you update them. in the meantime, could you add this command --continue.

So, you'll need to have this

SETSPACEPERMISSION" --continue"

That should allow you to skip errors and continue to the whole space list.

Cheers,  
Francis


author: Tommy Lee
body: [@Francis Batilo](/t5/user/viewprofilepage/user-id/4609548)

Looks like it only worked on one space, which is the space I already Recovered Permission, and have individual Admin permissions for. That one added the "confluence-admins-iinteractive" group in the script run.

All the other Spaces failed to add that group, probably because I'm not an Admin to those groups. So this is like a Catch-22, I cannot add group admin because i'm not an individual admin. Ugh.


author: Francis Batilo
body: [@Tommy Lee](/t5/user/viewprofilepage/user-id/5369881) ,

Could you check this for me.

So, there should be a default admin group for you in your cloud instance. If you go to products and select confluence then manage users/access, you can find the default admin group for that. If you add yourself into that, you won't necessarily need to be added into the space to modify its permissions.

Link: [Default groups and permissions \| Atlassian Support](https://support.atlassian.com/user-management/docs/default-groups-and-permissions/)


author: Tommy Lee
body: The script params didn't include Archive Page nor Mail Delete. (See screenshot for permissions for confluence-admins-iinteractive)

I tried again with "ARCHIVEPAGE" permission parameter and it worked. But couldn't find one that worked for Mail Delete though.

![image.png](https://community.atlassian.com/t5/image/serverpage/image-id/293502i67E572D86BF50FF6/image-size/large?v=v2&px=999 "image.png")


author: Francis Batilo
body: For Mail Delete: REMOVEMAIL

For Page archive: either PAGEARCHIVE or ARCHIVEPAGE


author: Tommy Lee
body: [@Francis Batilo](/t5/user/viewprofilepage/user-id/4609548)

I was already on both of the Default Group admin groups.

![image.png](https://community.atlassian.com/t5/image/serverpage/image-id/293506iF7E8B5977E7E29D5/image-size/large?v=v2&px=999 "image.png")


author: Tommy Lee
body: [@Francis Batilo](/t5/user/viewprofilepage/user-id/4609548)

Do you have any other ideas or suggestions?

I think I may have to somehow get into the one account that is already an individual Admin off all the spaces.


author: Tommy Lee
body: [@Francis Batilo](/t5/user/viewprofilepage/user-id/4609548)

Any other suggestions?


author: Francis Batilo
body: [@Tommy Lee](/t5/user/viewprofilepage/user-id/5369881) ,

I apologise for responding late. My other suggestion is updating the default permissions.

To do this you'll need to

1. go to settings (top right cog next to your name bubble)
2. navigate through the options on the left and find Space Permissions
3. Update the default space permission with the group that you have for the admins
4. Run the CLI script again

Let me know if this works


author: Tommy Lee
body: [@Francis Batilo](/t5/user/viewprofilepage/user-id/4609548)

That was the first thing we tried.

It doesn't work because that only sets the default permissions on newly created spaces. It doesn't change existing spaces, which is the problem we're trying to resolve.


author: Francis Batilo
body: [@Tommy Lee](/t5/user/viewprofilepage/user-id/5369881)

In that case, can you try this one instead?

[How to recover space permissions - One Appfire Support Knowledge Base - Appfire (atlassian.net)](https://appfire.atlassian.net/wiki/spaces/SUPPORT/pages/89149302/How+to+recover+space+permissions)

try running it once for the one that doesn't work and see if that will allow you to do something.


author: Tommy Lee
body: [@Francis Batilo](/t5/user/viewprofilepage/user-id/4609548)

I ended up "hacking" into Mike Eldridge's Atlassian account (going through several Google hoops because his Atlassian account is tied into our corporate Google Workspace). Then using his Atlassian account to run the CLI commands to add group permissions to all the spaces with your script above. This worked! And seems like the only route left. (Did not have to try your recover space permssions link above.)  

One more question. If I want to remove an individual user from space admin, what is the CLI script for that? We have an individual user that is an admin listed on all our spaces that I'd like to remove. (The "Microsoft Teams for Confluence Cloud" user.)![image.png](https://community.atlassian.com/t5/image/serverpage/image-id/295254iBF865BF823B8AEB8/image-size/large?v=v2&px=999 "image.png")


author: Tommy Lee
body: Got single command to work, but not the recursive one.

--action removePermissions --space CAN --userId "Microsoft Teams for Confluence Cloud" --permissions "@all"  

<br />

--action runFromSpaceList --common "--action removePermissions --space [@space](https://community.atlassian.com/t5/user/viewprofilepage/user-id/4882597)@ --userId "Microsoft Teams for Confluence Cloud" --permissions "@all""

I get there error:

Error: Parameter error: Unexpected argument starting with: Team


author: Tommy Lee
body: Aha I got it!  

--action runFromSpaceList --common "--action removePermissions --space [@space](https://community.atlassian.com/t5/user/viewprofilepage/user-id/4882597)@ --userId \\"Microsoft Teams for Confluence Cloud\\" --permissions "@all""


author: Tommy Lee
body: [@Francis Batilo](/t5/user/viewprofilepage/user-id/4609548) Sorry another question for you...

There is a ghost user that I cannot target with the script. It is the same user, but some spaces say he's Deactivated, because that user is deactivated. I tried to reactivate the user and I still could not target him with the script to remove his Confluence permissions. Any thoughts on this?

![image.png](https://community.atlassian.com/t5/image/serverpage/image-id/295282iEC4898457A308A79/image-size/large?v=v2&px=999 "image.png")![image.png](https://community.atlassian.com/t5/image/serverpage/image-id/295283iFA661EC2D2F5BC63/image-size/large?v=v2&px=999 "image.png")


author: Tommy Lee
body: I figured this out as well!

I found user John's Atlassian accountId from his user profile page url. (ie. <https://example.atlassian.net/jira/people/123456:59635b21-a884-4b71-3b3-8af2467db111>)

And I used that ID in the ACLI script for userId and it found and removed all of John's permissions. Yay, finally, permissions are all cleaned up!


author: Francis Batilo
body: [@Tommy Lee](/t5/user/viewprofilepage/user-id/5369881) , sorry for responding late. I'm glad that you've figured it out and you're able to use the CLI tool. It is a handy app while you're in the cloud, given that we can't go directly to our databases.

If you have further questions, please let me know or post another question in the community board.

Thank you again for your patience and I really appreciate you trying out the option I suggested :).

Cheers,  
Francis


Tags: cloud

cloud-migration

confluence-cloud

migration

permission

space