Clarification: Customer Access vs Email Channel Allowlist in Jira Service Management

[Pavankumar Machireddy]

Hello All,

We have a requirement to restrict external users/domains (e.g., gmail.com) from raising requests via both the customer portal and the email channel in Jira Service Management.

We tested the following configurations:

• Email channel allowlist
  Project settings → Channels and self-service → Email → Manage allowlist
  However, even when a domain is not added to the allowlist, users are still able to create tickets via email if they are allowed under Customer Access.

• Customer Access – External
  Customer access → External → Only allow account creation for customers with specific email domains
  When domains are allowed here, users can create requests via both portal and email, regardless of the Email allowlist configuration.

This raises a couple of questions:

1. What is the intended purpose of the Email channel “Manage allowlist”, and when is it actually enforced?
2. Which setting takes priority — Customer Access domain restriction or the Email allowlist?
3. To restrict external domains from raising tickets on both portal and email, is configuring Customer Access → External domain restriction is it the correct and sufficient approach which i am doing?

Looking for clarity on the expected behavior and best practice for this use case.

Thanks in advance!

[Gunjan Kumar]

Hi @Pavankumar Machireddy 

Your understanding is right. In JSM, the email allowlist doesn’t actually control who can raise requests, it only affects how emails are handled. So if a user is already allowed through Customer Access, they can still create tickets via email even if their domain isn’t in the allowlist.

To properly restrict external domains, the correct setting to use is Customer Access -> External -> allow only specific email domains. This controls access for both the portal and email. Just keep in mind that users who are already added as customers can still raise requests, so you may need to remove them if you want to fully enforce the restriction.

[Arkadiusz Wroblewski]

Hello @Pavankumar Machireddy 

From what you described, your understanding is basically correct.

The Email channel allowlist is not the setting that decides who is allowed to raise requests in general. Its purpose is to make sure emails from trusted domains are never filtered out by the email channel. The opposite control for email is the blocklist, where messages from listed domains or addresses are always filtered out.

For your second question, I would say Customer Access / Channel access is the effective controlling setting for who can create requests through portal and email. Atlassian’s current JSM docs say that channel access controls who can send requests through the portal, widget, and email, and the customer access settings also control whether customers can create accounts by sending an email request. That matches the behavior you saw in testing.

So for your third question: yes, if your goal is to restrict external domains from creating tickets through both the portal and the email channel, then configuring Customer access → External → only allow account creation for customers with specific email domains is the right primary approach.

[Pavankumar Machireddy]

Great explanation @Arkadiusz Wroblewski Thanks!

[Himanshu Tiwary]

Hi @Pavankumar Machireddy ,
Customer Access domain restriction is the correct setting to enforce this use case
follow customer Access > External > allow only specific email domains to controls who can raise requests through both the portal and email.
Basically Restrict domains in Customer Access and, if needed, use the email allowlist/blocklist only as an additional email-channel control.

[Pavankumar Machireddy]

Thanks for clarification! @Himanshu Tiwary