Can I allow external emails to send requests to JSM projects, but restrict help portal access?

[Cam Briggs]

I use JSM enterprise. I have a number of JSM project, some of which use email only issue creation, with most others utilising forms in the help portal. I currently have ‘external customers can create accounts via the portal’ open, as I understand this to allow externals emails to reach my projects that require it. But some of the forms contain potentially sensitive information. Has anyone been able to achieve this config? Can I stop externals from creating their own customer accounts whilst also allowing them to email addresses for certain projects and have issues created?

[Olha Yevdokymova_SaaSJet · Accepted solution]

Hi @Cam Briggs 

With Jira Service Management Cloud today, email channel access and Help Center account creation are coupled more than most teams expect.

If you disable “External customers can create accounts”, Jira will also block:

• Issue creation via incoming email from unknown external senders

• Portal access for anyone without an existing account

You can reduce exposure, but not fully solve it:

• Lock down request type visibility so sensitive forms are only shown to specific organizations or customer roles

• Use separate projects for email-only intake vs. portal-based intake

An alternative approach some teams use

One pattern I’ve seen work well is moving the “external but sensitive” intake out of the Help Center entirely, while still ending up with Jira issues.

For example, with Smart Forms for Jira:

• You can create a public form link that’s accessible without a Jira or Help Center account

• The form can collect structured and sensitive information (with validation, conditional logic, required fields, etc.) so you can validate email field

• The form works without creating customer account, form avaliable to everyone or to restricted users, but no accpunt creation

• Submissions automatically create issues in the correct JSM project with field mapping

• The Help Center can remain locked down (no self-registration needed)

• Forms can be shared via link(like for emails) or added to JSM portal request

So you can recreate forms for email channel with Smart Forms or recreate forms for customer portal and users will submit your requests without account creation
The forms can be created via non agents and used also in software projects, so it can be not only service intake for your team. 

This doesn’t change JSM’s email behavior — it simply avoids using the portal for cases where account creation is a risk.

[Cam Briggs]

Thank you @Olha Yevdokymova_SaaSJet  this is very helpful

[Marc -Devoteam-]

Hi @Cam Briggs 

You can set permission on request types, by user or groups, so only the listed user and or groups can use these request types.

If user can signup signup, the is no option to disallow them on using the portal.

[Cam Briggs]

Thanks @Marc -Devoteam-  I'll give this approach a try.

[Sebastian Krzewiński]

Hi @Cam Briggs 

If someone (internal or external user) is a customer in JSM project then is able to use any channel that you offer in that project which mean that will be able to see portal and send email.

Regards,

Seba

[Cam Briggs]

Thanks Sebastian. What I’m trying to work out is, is there a way to restrict access to the portal OR forms within the portal to external customers who create their own account via the portal login page.