Organization-level Setting to Enable/Disable Project Creation by Members

[leedongwei]

Problem Statement

We made some changes to allow users with "member" roles are allowed to create new sentry projects.

This affects some organizations' access control policies.

Solution Brainstorm

We'll have a organization-level setting for users with owners/managers roles to disable this.

Product Area

Settings - Projects

[getsantry]

Routing to @getsentry/product-owners-settings for triage ⏲️

[amoise-bd]

Seems like an unfortunately choice to let any member create project when you already had this action done by managers, admins, owner, team admin ...
What was the exact business or technical justification to do this ? Because for sure i can thing of several reason why project creation should be limited only to Manager and Owner

And where is this defined in https://docs.sentry.io/product/accounts/membership/ ?

[Dhrumil-Sentry]

@amoise-bd thanks for your feedback. We've heard two different types of feedback from customers here

• One cohort has a centralized process to manage tools like Sentry and needs controls so that not everyone can take such actions
• Another cohort wants democratized access- and since we don't allow members to create projects they are forced to make everyone an Admin which has its own set of problems

We will update the docs for that- it's in progress already and apologies for that miss cc @leedongwei @sentaur-athena

We understand that this creates problems for customers such as yours who are in the first cohort and we'll add a toggle to turn this off in the organization settings. We anticipate this will get done in the next few weeks

[amoise-bd]

From our opinion it is a totally unfortunately choice to release such a feature without the possibility to have it overwrite at a company level.

Q: Why don't you implement an option to allow users to configure their chosen mapping between "Actions" and "Roles"

• This way one could even give "project creation" permission to billing and why not, remove organization to members.
• And any other parties that need to have a clear structure, control, synchronisation, compliance between their project can give the "create project" role only to manager (for example)

P.S. It will be interesting to see Atlassian implement the option to allow any user create a new jira-project, confluence-page of bitbucket-project ...

[leedongwei]

@amoise-bd I'll add a organization-wide setting for this. ETA before Christmas holidays.

[leedongwei]

Unfortunately, I didn't get to this task earlier this week. It's implemented in these two PRs but I'll wait till folks return to office before we merge them.

• feat(project-creation): Add bitfield flag for org-wide setting #62277
• feat(project-creation): Backend for disableMemberProjectCreation flag #62294

[realkosty]

We have a major enterprise customer very interested in this in the context of quota management. Their Sentry admin team wants to lock down project creation so everyone has to go through them.

[Dhrumil-Sentry]

@realkosty Danny's change is meant to prevent Org members from creating projects- Thats a change we've made for business plans and Danny is building an opt out for those customers.

Does this customer want only owners to be able to create project?

[realkosty]

@Dhrumil-Sentry yes, they want only owners (or managers maybe too?) to be able to create projects. They would like to prevent ideally both Members and Team Admins from doing so. But members alone would be better than nothing.

[dalnoki]

Hi @Dhrumil-Sentry, a customer is interested in the ETA for this feature, is there any news that I can share with them?

[Dhrumil-Sentry]

@leedongwei can you please share more details about an ETA please

[jboeijenga]

@leedongwei: any update on this?

[leedongwei]

Updating this ticket. #62603 and #62294 were merged a while ago. We've added the feature into the organization's General Settings page.

It is limited to organizations on Biz Plan.