How to automatically add users from outside of the workspace to specific roles/groups?

[Christopher Carvalho]

We have a customer-facing portal, where after submitting their tickets to us they have access to their tickets within our workspace.

The problem is that they end up visualizing the tickets of other customers from other companies.

The solution we thought: A security scheme automation that will automatically set the security level of the work item submitted by the user to a specific one related to their company, based on their reporter email domain. This should ensure that they only visualize the work items of their respective companies and hide the work items of the other companies.

The problem: As we have many customers submitting tickets to us, it is very troublesome to manually add each and every user to the security level. We could do it via groups, but then we have to manually add every single new user to their respective group which is a hassle.

As we can add groups to the security levels, is there a way to automatically add users to specific groups based on their reporter/email domain?

Example: If reporter email contais @companyXYZ.com, assign to group "Company XYZ"

Is the above doable? Are there any other means of accomplishing it?

[Jayesh Raghuvanshi]

@Christopher Carvalho 

Don’t use groups for portal customers in Jira Cloud; use Jira Service Management Organizations and auto-assign customers to their org by email domain, then restrict customer sharing to their own organization so they only see their company’s requests. You can optionally use automation to always add the reporter’s organization to the request and control whether new requests are auto-shared with the org by default

Why: Customers can see others’ requests when project Customer permissions allow sharing or searching beyond their organization, or when requests are shared with a broader audience by default. If users from different companies were accidentally placed in the same Organization, they will see each other’s organization-shared tickets in the portal requests list.

My suggesstion:

• Create a Customer Organization per company, then add that Organization to the relevant service project(s) so its members can raise requests there and share within the org
• Add the customer’s email domain(s) to the Organization; new customers whose email matches those domains are automatically added to that Organization (up to 10 domains per org; existing customers are not retroactively moved)
• This removes the need to manage groups and scales cleanly as new portal customers join, because domain matching handles the assignment to the correct Organization automatically

Thanks
Jayesh R

[Christopher Carvalho]

Hi @Jayesh Raghuvanshi 

Thank you so much for your input!

However, as the number of customers from different companies we deal with is quite big, we would still have to manually create a new organization every single time.

Are there any ways to automate this process if a customer submits a ticket from a domain that still doesn't have an organization?

[Jayesh Raghuvanshi]

@Christopher Carvalho 

There’s no native “auto-create Organization by email domain” in Jira Service Management Cloud, but you can fully automate it with the JSM REST API (create Organization, attach it to the service project, add the reporter to it, and set the issue’s Organizations field) or use a marketplace SSO/Identity app that maps users to Organizations by domain.

Thanks
Jayesh R

[Christopher Carvalho]

@Jayesh Raghuvanshi  I was checking for some extra solutions and found this: https://community.atlassian.com/forums/Jira-Service-Management/Utilise-reporters-email-domain-to-create-an-Organisation-if-it/qaq-p/2745250

It seems we can create a new organizations based on the reporter's email domain if the organization doesn't exist, I still need to test it though.

Leaving it aside for now, how can I limit user visibility of work items based on their organization? All related articles or community post seemed to send me back to security schemes solutions...

[Duc Thang TRAN]

Hello @Christopher Carvalho 

I think security is an alternative solution, but it’s complex to maintain.
You can try organizing it with Jira Service Desk. -> https://support.atlassian.com/jira-service-management-cloud/docs/group-customers-into-organizations/
& for domain -> https://support.atlassian.com/jira-service-management-cloud/docs/use-email-domains-to-automatically-group-customers-into-organizations/

Summary  : It is a solution that enables customers to share and view requests within the same organization.
A customer can be part of multiple organizations, so it supports complex sharing configurations if required.

BR

[Christopher Carvalho]

Hi!

Thank you so much for your input!

However, as the number of customers from different companies we deal with is quite big, we would still have to manually create a new organization every single time.

Are there any ways to automate this process if a customer submits a ticket from a domain that still doesn't have an organization?