Prevent Customers from same Organization for Viewing each other's TIckets

[Nickolas Fistopoulos]

Hi there,

It seems Customers from the same Organization are able to View each other's tickets when visiting their Customer Support portal.

Within Customer Permissions, we are currently using:
"Customers can search for other customers within their organizations".

This allows the Submitter to share their ticket with others within their same Organization, by leveraging the Share function, which is great.

However, if they choose not to Share their ticket (e.g., sensitive, private information), others from the same Organization can still view all tickets via the Customer Support portal by selecting the "Shared with my organizations" drop down arrow/filter.

Basically, all Customers from the same organization can view each other's tickets, although the Submitter has not shared.

Please let me how we can prevent this from happening.  At the moment, sensitive/private information is visible to others.

Thanks!

[Jeroen Poismans]

Hi!

You are looking in the correct spot. on the same page you will find this:

It will open a new Configuration page (The config for JSM Globally):

This changes the default sharing to be intrinsic instead of by default.

Hope this helps!

[Nickolas Fistopoulos]

Thank you very much Jeroen!
I will ask our JSM Admin to follow these exact instructions.

I appreciate the super quick reply!

Enjoy your day!

Thanks,

Nick

[Nickolas Fistopoulos]

Hi @Jeroen Poismans 

Unfortunately, this this did not work.
Our Admin confirmed your recommended setting was actually already enabled.
I just submitted a Test ticket, but the issue persists.

Screenshot 1 - View of our Sharing permissions
Screenshot 2 - View of a Test ticket

Screenshot 3 - View of the Test ticket from the Submitter's end

Screenshot 4 - View from another Customer from the same Organization as the Submitter (with All selected) from the Ticket list section of the Customer portal.

Any idea?

Thanks,

Nick

[Jeroen Poismans]

Hi,

Can you check if there are any automations active that might cause this? I set up exactly the same scenario and doe not experience this behaviour.

Also check the activity tab on the workitem, I might indicate when the workitem got shared.

[Nickolas Fistopoulos]

Thanks Jeroen.

We have 8 Automation rules in place that trigger based on Work Item Creation (they're used for Notifications mainly).

We disabled all 8 rules, and created 2 Test tickets.

The issue persists though.

We have Fake User 1 under Organization Test Company.
We have Fake User 2 under Organization Test Company.

We created 2 Test tickets as Fake User 1, and we left the "Share With" field with the default value of "No One".

Then, we signed into the portal as Fake User 2.

When Fake User 2 goes goes to view tickets, and selects Status = Open Requests (All), Fake User 2 can see both Test tickets submitted by Fake User 1.

Is there anything else we can look at?

Thanks,

Nick