Troubleshooting

The coverage line says “partial”

Something the scan needed could not be read. This is the app working correctly — it is telling you it fell short rather than showing you a report that looks complete.

Go to Activity. The run log lists each skipped item individually with the reason. That is usually enough to classify it:

• A transient API failure or rate limit. Rescan. An incremental run has much less to read, so it frequently succeeds where the first attempt did not.
• A configuration issue — a scheme or group in an unusual state. The named item is the place to look.

Treat anything derived from a missing piece as unmeasured, not as empty. A project whose scheme could not be read is not a project with no access.

A scan seems stuck

Check Activity for the run’s actual state before assuming.

Scans run server-side and are not driven by your browser, so a page that has been open a while may simply be showing you a stale view. Reload it.

Large first scans genuinely take a while — that is the one run that has to read everything. See Scan cost and quota.

If a run has genuinely stalled, the app says so rather than showing a progress bar that never advances. Start a new scan; the previous complete report stays readable throughout.

The report shows an account I did not expect to have access

That is the product working. Open the account and read the derivation — it will name the group, role, and scheme that produced the grant.

The usual cause is a group somebody was added to for an unrelated reason, which happens to be an actor in a role that a scheme grants something to. That is exactly the chain no native screen shows you.

Check for multiple routes before you revoke anything. If the account reaches the permission by more than one route, all of them are listed, and removing one leaves the access in place.

An account shows no access but I know they can see things

Two likely explanations, in order:

1. Issue security schemes are out of scope. They restrict access within a project, not to it, and are a separate mechanism this report does not resolve. They cannot grant access the permission scheme does not — but they can complicate the picture.
2. The access is class-based. “Anyone with a Jira licence” and “whoever is assigned the issue” are real access with no individual to attribute it to. It is reported under Projects, grouped by holder, rather than against each named account.

A project shows as unreachable

Usually a real finding, not a fault. The common causes are a scheme granting only to a role with no actors, or only to a group with no members. See Projects.

An unreachable project is distinct from a project the scan could not read — that appears as partial coverage instead, and the app never presents one as the other.

A deactivated account still shows access

That is a finding, and it is one of the more common ones. The licence was removed; the group membership was not. Open the account, read the derivation, and remove the membership that produces the grant.

If your offboarding deliberately keeps accounts deactivated-but-granted for a retention period, you can turn the flag off in Settings.

The app will not open

Opening it requires the Administer Jira global permission. A project administrator without site-admin rights cannot reach it through Jira Settings. This is a property of the admin page module, not a setting.

History has a gap

A date with no completed scan has no record, and the report says so rather than inferring the state from the days around it. See Permission history.

Common causes: continuous scanning was off for that period, or a scheduled run did not complete. Activity shows which dates have a completed scan behind them.

Getting help

Email support@quintek.com.

We have no view into your installation — no console, no database, no access to your data. The one thing Atlassian shares with us is the app’s diagnostic log (timings, counts, error text — and your admin can switch that off), so the more of this you can include, the faster we can help:

• what you did, what you expected, and what happened instead
• the scan’s entry in Activity: its mode, duration, coverage, and any skipped items
• roughly how large the estate is — projects, distinct permission schemes, accounts
• your edition, and whether continuous scanning is on

You decide what to send. Nothing reaches us that you do not choose to share.