Change who can find content and what they can do with it
Set view and edit restrictions on a content item that you're not ready to share with everyone, or on one that contains sensitive information
Confluence admins control this. At the global level, admins can control global permissions, such as who can create spaces in Confluence, and default space permissions, where admins can configure the default permissions settings for new spaces created.
Space-level permissions
Space admins control this. At the space level, admins decide what each user or group can do in that space.
Content-level permissions
Anyone who has permission to edit the content and to overall edit content in the space can change access to content items.
Tip: If there are no content restrictions on a content item but someone still can't view or edit it, it's likely because they don't have the necessary space permissions. See Troubleshoot access problems to content to learn more.
Open by default
Confluence is open by default, which means it starts from a place of ‘everyone can access everything’ but lets you restrict where you need to.
Confluence groups
Instead of applying restrictions to individuals, use Confluence groups to save on typing out individual names.
Additive permissions
Confluence permissions are additive. This means that if someone is in two Confluence groups, and one group has permission to view a content item while the other does not, that person will still be able to view the content item because at least one of the groups they're in has permission to view it.
A restrictive model
Confluence's permissions model is set up so that content can only be further restricted from whatever the container is set at. A content item cannot have greater access than its container, which may be the space or another content item.
Anonymous access
You can make certain spaces (or even your whole site) available to the public, which means that anyone on the internet would be able to access your content.
Mentioning users
If a user doesn't have access to the content, they won't receive a notification when @ mentioned.
The new content sharing and access experience is currently rolling out to all customers. If you don’t see it yet, you will soon!
Even in a shared space, you may have content that you're not ready to share with everyone yet. Or perhaps you have some content that's only meant for a few eyes. Whatever the reason, Confluence lets you set view and edit restrictions at the content level so you can keep your content as open or as closed as you need.
You can’t restrict access to content on the free plan.
The first step to changing who can access your content is understanding who currently has access to it.
Confluence’s core tenet is about getting the right knowledge to the right people in your organization. To support this, Confluence’s permissions are open by default, which means that the content wants to be available to everyone unless otherwise noted.
The fundamental piece of this open-by-default model is represented by General access. This refers to the general audience for the content item — everyone who has at least view access to the space a content item lives in, or, if a parent item is restricted, everyone who has at least view access to the parent item.
To check who currently has access to the space:
Open the Share window.
Find General access.
Select this space in the line “Anyone in this space”
If the content item is restricted by a parent, then you can check who has access to the parent item by selecting this parent in the line “Anyone on this parent”
To learn more about space access, see Assign space permissions.
You can set general access to 3 states of permissions:
Open > Anyone can edit
Open > Anyone can view
Restricted > Only specific people can view or edit
Open > Anyone in this space can edit | No restrictions. Consume whatever the space’s access settings are. For example, anyone who has permission at the space level to edit content can edit this content; however if someone lacks space-level permission to edit content, then that person won’t be able to edit this content, even though this content’s access is set to Open > Anyone can edit. |
---|---|
Open > Anyone in this space can view | All editing is restricted to specific people. Even if people have permission at the space level to edit content, they can’t edit this content unless they’re explicitly listed with Can edit in Specific access (individually or as a member of a group). |
Restricted > Only specific people can view or edit | Even if people have permission at the space level to view and edit content, they can't view or edit this content unless they’re explicitly listed in Specific access (individually or as a member of a group). |
Restricted by a parent > Anyone on the parent can edit | No direct restrictions; restrictions are inherited from a parent item. So consume whatever the parent content’s view access settings are. Anyone who has permission to view the parent content can view this content. Note: Edit permission is not inherited from content to content. Even if people don’t have edit permission on the parent content, they are not prevented from editing this content. |
Restricted by a parent > Anyone on the parent can view | Anyone who can view the parent items can only view this page — unless they’re explicitly listed on this page as having permission to edit (individually or as a member of a group). |
Restricted > Only specific people can view or edit (“Restricted by a parent” scenario) | Even if people have permission to view and edit the parent content, they can’t view or edit this content unless they’re explicitly listed in Specific access (individually or as a member of a group). |
Learn why someone can't edit, even if the General access setting suggests that they can.
If someone can’t view a parent content item, they won’t be able to view any child content items under it. In this sense, a view restriction has been added to the parent item that inherits down to all content items nested under it, without exception.
Editing doesn’t work this way. Even if someone is restricted from editing a parent item, they won’t automatically be restricted from editing the child content.
However, if someone is restricted from editing at the space level, they will be restricted from editing any and all content in that space.
If your content has view restrictions, it won't display for anyone who doesn't have permission to view it, neither in the content tree nor any macros.
Unless someone else has specifically been given a link to your content, they won't know it exists.
Exceptions:
If someone has shared a link to a restricted content item or provided a link to it on another content item that can be viewed, the link will have the title of the content item as part of the URL. However, they won't be able to tell anything else about the content, including who created it, who has permission, or when it was updated.
Organization admins on the Premium and Enterprise plans can view and change access to any content in Confluence with admin key.
To list a person or group with specific access, you’ll need to add a restriction to the general access of the content item, then add individuals or groups. (Teams are not supported in the unified sharing experience yet.)
For example, in an “Open” state, you can change the permission for anyone in the space from “Can edit” to “Can view”. This will restrict who can edit the content item. In this state, you can then use the search bar to add people or groups to Specific access with “Can edit” permission.
This is useful for content that should be distributed widely but only edited by a small team.
Or you can set General access to “Restricted”. In this state, you can add people or groups to Specific access freely with “Can edit” or “Can view” permissions.
When anyone can edit, no one can have specific access
Individual people and groups only appear in the list with specific access when they have greater access than the General access setting.
For example, if General access is set to Open > Anyone can view, anyone with Can edit will have greater access than the general access and therefore are notable to list in specific access.
However, if General access is already set to Open > Anyone can view and edit, then there’s no greater access possible. Therefore, there is no relevant specific access to note.
If you’re having trouble getting people the right access, see Troubleshoot access problems to content.
Open Share on the desired content item.
Find the person or group whose access you want to remove.
Open their dropdown.
Select Remove.
If the content is in an Open > Can edit state, set General access to “Restricted” and select Save. This will remove access for everyone but you.
If the content is already in a “Restricted state”, you can quickly clear the board and make the content private by selecting Remove all.
If the content is in an Open > Can view state with multiple editors, set General access to Restricted and then select Remove all to remove everyone but yourself.
Basically, if no one but you is listed in Specific access while General access is set to “Restricted”, then the content is private to you. If General access is set to Open or if other people are listed in Specific access, then the content is not private to you.
As a tool for communication and collaboration, we believe Confluence is at its best when everyone can participate fully. Confluence keeps a history of all changes to pages and other content, so it's easy to see who has changed what, and reverse any changes if you need to.
Confluence does, however, give you the choice to make your instance, spaces, and pages as open or closed as you want to.
Permissions and restrictions aren’t customizable on the Free plan.
There are three levels of permissions in Confluence: global permissions, space permissions, and page restrictions.
Global permissions are Confluence-wide permissions, and are assigned by Confluence administrators.
These permissions are pretty broad, and don't really interact with space permissions or page restrictions.
For full details, check out the Manage global permissions in the Administrator's Guide.
Every space has its own independent set of permissions, managed by the space admin(s), which determine the access settings for different users and groups.
They can be used to grant or revoke permission to view, add, edit, and delete content within that space, and can be applied to groups, users, and even to anonymous users (users who aren't logged in) if need be.
One thing to watch out for is where a user is a member of multiple groups. You may have revoked permission for that individual user to add pages, for example, but if they're a member of a groups that is allowed to add pages, they'll still be able to create new pages in the space.
If you can't get the result you want from space permissions, or you're not sure, check with one of your Confluence administrators to determine what permissions you should apply to individuals and groups.
Page restrictions work a little differently to global and space permissions. Pages are open to viewing or editing by default, but you can restrict either viewing or editing to certain users or groups if you need to.
Don't forget, every page in Confluence lives within a space, and space permissions allow the space admin to revoke permission to view content for the whole space. Even the ability to apply restrictions to pages is controlled by the 'restrict pages' space permission.
You can restrict viewing of a page or blog post to certain users or groups, so that even if someone has the 'view' permission for the space, they won't be able to view the content of the page or blog post.
If someone's a space admin and you've used page restrictions to prevent them viewing a page, they won't be able to see the page when they navigate to it. As a space admin though, they can see a list of restricted pages in the space and remove the restrictions.
Space permissions and page restrictions affect how links between Confluence pages are displayed.
If someone doesn't have 'View' space permission, links to pages in that space won't be shown at all.
If someone has the "View" space permission, but the page has view restrictions, the link will be visible but they'll get an "access denied" message when they click the link.
Links to attachments are also affected. If the visitor doesn't have permission to view the page the attachment lives on, the link won't be rendered.
The new content sharing and access experience is currently rolling out to all customers. If you don’t see it yet, you will soon!
Confluence offers a few different tools to help you troubleshoot access problems to content, whether you’re trying to figure out why someone can’t access a page or why someone can access it but shouldn’t.
There are a few different reasons why someone wouldn’t have the level of access they should.
The first thing to remember is that permissions in Confluence are inherited from the container above. This means that if someone doesn’t have access to a content item, then it could be because of:
settings on the content item itself,
settings inherited from one of its parent items,
and/or settings inherited from the space.
You may be able to fix access issues, depending on where the access issue is coming from.
Issue on the content item itself — To fix these issues, you need to have edit access to the content and space-level permission to edit content restrictions, or else contact someone who does.
Issue inherited from a parent item — To fix these issues, you need to have edit access to the parent item and space-level permission to edit content restrictions, or else contact someone who does.
Issue inherited from the space — To fix these issues, you need to be a space admin, or else contact one.
For a list of all space-level permissions and what they control, see Assign space permissions.
Confluence will let you know when you try to share with people who won’t actually be able to access the content before you’re finished sharing with them.
Confluence will also tell you when someone already added to the content doesn’t have the indicated access to the content, but only when a person or a group has been explicitly added to the Specific access list.
This in-line warning message will only appear when a listed person or group:
needs space access
needs view access to a parent item
needs permission at the space level to edit content in the space
Confluence will tell you when content inherits access restrictions from one of its parent items in the content tree.
To troubleshoot inherited access problems:
Open the Share window on the content item you want to give someone access to.
Select this parent in the statement “Anyone on this parent”. This will take you to the immediate parent item causing the access restriction. (There may be other parent items with view restrictions.)
Open the Share window on that parent item and see if the person or group has access. If not, add them.
After adding them, if this parent item doesn’t inherit restrictions from any of its parents, go back to the original content item and refresh to confirm the access problem has been resolved.
If this parent item does inherit restrictions from one of its parents, follow the same process until you’ve added the person or group to all restricted parents.
If you have permission to move content in the space, you can also try moving the child content out from under the restricted parent item where it’s organized in the content tree.
An easier way to troubleshoot on Premium
If you’re on the premium plan, you can use the inspect permissions feature to easily see at which levels of hierarchy someone is being denied access (parent content, space, and/or product).
You can find this feature in the Share window, in the More options menu (•••).
If someone can access content they shouldn’t, there are a couple of things to consider.
First, you can remove access for everyone and individually add back only the people who should have access.
To remove access for everyone and add back individually:
Open the Share window.
Change General access from Open > Restricted.
Add individual people or groups back to the access list.
Select Save.
Second, you might need to look for additive permissions.
Confluence operates on a model of additive permissions, which means that if someone has access to content in two or more ways, they always get the greater access.
For example, let’s say you have a page that is restricted to the group “Marketing team”. Only that group should be able to view and edit the page. This means that General access is set to “Restricted” and that the group “Marketing team” appears in Specific access with “Can edit” permission.
But let’s say that Omar, who is a member of the “Marketing team” group, should not be able to edit the page, and to accomplish this, someone added Omar explicitly to the page with “Can view” permission. This does NOT mean Omar is restricted from editing the page.
This is because, even though Omar is explicitly listed as “Can view”, he can still edit the page because he has access to the page through another source — as a member of the “Marketing team” group — which has “Can edit” assigned.
Thus, part of troubleshooting why someone has a certain level of access to content that they shouldn’t have is figuring out all the ways they might have access and determining the greatest access across those sources.
We’re in the process of rolling out these changes and the documentation may not match your experience. Bear with us while we update it to reflect the new changes. More about navigating the new Confluence
Confluence lets you customize permissions at the site, space, and page level so that they're just right for you.
You can’t restrict access to content on the Free plan.
Here's a quick rundown of permissions at different levels within Confluence:
Global-level permissions
Confluence admins control this. At the global level, admins can control global permissions, such as who can create spaces in Confluence, and default space permissions, where admins can configure the default permissions settings for new spaces created.
Space-level permissions
Space admins control this. At the space level, admins decide what each user or group can do in that space.
Content-level permissions
Anyone who has permission to edit the content and to overall edit content in the space can change access to content items.
Tip: If there are no content restrictions on a content item but someone still can't view or edit it, it's likely because they don't have the necessary space permissions. See Troubleshoot access problems to content to learn more.
Open by default
Confluence is open by default, which means it starts from a place of ‘everyone can access everything’ but lets you restrict where you need to.
Confluence groups
Instead of applying restrictions to individuals, use Confluence groups to save on typing out individual names.
Additive permissions
Confluence permissions are additive. This means that if someone is in two Confluence groups, and one group has permission to view a content item while the other does not, that person will still be able to view the content item because at least one of the groups they're in has permission to view it.
A restrictive model
Confluence's permissions model is set up so that content can only be further restricted from whatever the container is set at. A content item cannot have greater access than its container, which may be the space or another content item.
Anonymous access
You can make certain spaces (or even your whole site) available to the public, which means that anyone on the internet would be able to access your content.
Mentioning users
If a user doesn't have access to the content, they won't receive a notification when @ mentioned.
Change who can find content and what they can do with it
Set view and edit restrictions on a content item that you're not ready to share with everyone, or on one that contains sensitive information
Confluence permissions structure
Gain a general overview of Confluence Cloud's permissions model.
Troubleshoot access problems to content
Solve any issues you're having with people accessing your content.
Was this helpful?