We’re setting up a Jira Service Management Portal so our staff (who don’t have Jira licenses) can submit simple requests as customers.
We don’t want the portal to be accessible to anyone outside our organization.
Here’s how we configured it:
* Channel access is set to Restricted (so it’s not open to everyone).
* We approved our domain name.
* Under App access settings, for our domain, we selected Jira Service Manager – Customer.
Here’s what’s happening:
*If someone with a random external email tries to access the portal, they’re blocked — which is what we expect.
*If someone with an email from our approved domain tries to access it, they’re prompted to create an account. After signing up, they see this message:
“Join your team on Jira — [xxxxx] has approved your email domain so you can join Jira right away.”
There’s a button that says “OK, let’s go.”
But after clicking it, they land in the portal and get a “Permission Denied” error.
From what we understand, if we manually invite users to the portal, they would probably get access. But we’re trying to avoid manually adding every new employee.
Has anyone run into this before? Are we missing a setting somewhere?
Just to confirm that your org wants full locked-down on who can access your JSM portal right?
Please confirm...
You may also review the following KB article regarding to "Add a customer to a service space" - https://support.atlassian.com/jira-service-management-cloud/docs/add-a-customer-to-a-service-project/
Best, Joseph Chung Yin
Yes we do want to lock it down to users from specific domain only
This article explains how to manually add them. Its not what we want. We want them to be able to self-register if they belong to a specific email domain
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
I think you can probably consider setting up user provisioning and SAML SSO for the JSM customer:
In this case, you can ensure that customers in the directory have access to your portal and remain in control.
In addition, you can consider setting up an IP allowlist, which restricts users to your company network only.
Thank you.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
I believe this requires Atlassian Guard and we are trying to keep the cost as low as possible
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.