confluence-administrators vs. "regular" administrators?
Asked by Cody:

I have an employee who is our resident "confluence power user". I'd like for him to be able to do *everything* on the site *except* see every page on the site. For instance, there are other employees financial information/performance reviews/etc. and he shouldn't have access to this. What is the best way to handle that.   

Is there something like a "confluence-administrator-lite"?


Answers:
author: Ryan Carpenter
body: Yes. In the Confluence settings, go to Global Permissions and create the *confluence-admins-lite* group, and give the group *Confluence Administrator* permission but *not System Administrator* permission.

![20200524-550_chrome.png](https://community.atlassian.com/t5/image/serverpage/image-id/96155i691AE85A5DEB43CC/image-dimensions/434x104?v=v2 "20200524-550_chrome.png")

Users in the confluence-admins-lite group will have access to the Confluence admin panel, but will not be able to edit the System Administrators group and will not be able to edit their own groups to become a System Administrator.

Users in *confluence-admins-lite* will be able to edit their own groups, and the *System Administrators* group will appear as an option. However, selecting a group with system administrator permission and attempting to save produces the following error message (in Confluence Server 7.3.2).

![20200524-549_chrome.png](https://community.atlassian.com/t5/image/serverpage/image-id/96156i15120993B5EBE0E6/image-dimensions/489x70?v=v2 "20200524-549_chrome.png")

You can now control page access through page permissions. Make sure to consider any additional precautions needed to make sure that sensitive content will remain in the restricted space and that unrestricted pages containing sensitive content will not get created. And of course, test everything thoroughly before implementing any of these suggestions. Results may vary. I could be wrong. There may be something else important to consider.

More information:

* [Confluence Admin Permissions Explained](https://confluence.atlassian.com/confkb/confluence-admin-permission-levels-explained-604209420.html)
* [Global Permissions Overview](https://confluence.atlassian.com/doc/global-permissions-overview-138709.html)


author: Ryan Carpenter
body: Do you really mean *absolutely everything*, including site-wide configuration of the application (i.e., via the administration panel), or "everything" related to administering content and spaces? If the former, ordinary Confluence permissions alone would not provide a bullet-proof solution. If the latter, you could use the space administrator setting.

comments: author: Cody
body: I think so- but I don't know what I don't know. He is the user who sets up spaces, manages permissions, etc.   

i don't know if anything that I wouldn't want him to do- except see every page, or make it possible for himself to do so.


author: Ryan Carpenter
body: You might be able to use network-level firewall controls as a workaround, while still allowing full control. For instance, by blocking access to the url for administration of the sensitive-content-group and the power user's own group membership admin (NB: amateur idea). Even so, users within the sensitive-content-group can also break the security, for instance, by accidentally posting in the wrong space. You may need to examine the risks beyond those associated with the admin.


author: Ryan Carpenter
body: Pardon me. You can make a group of your own, separate from the confluence-administrators group, that has "Confluence Administrator" privileges and not "System Administrator" privileges. The permissions of your *confluence-admins-lite* group will look the same as the *confluence-administrators* but there may be some special functionality of the predefined group. I am not sure about this, so you will need to test the lite group and/or get more information from Atlassian or someone who can give a definitive answer.


author: Ryan Carpenter
body: Scratch this. I have posted a new response with more accurate information.


Tags: cloud