How to prevent external customers from seeing the user list in Assignee filter and column Jira

[Ivan Andrieiev]

Context

We have two external customers who have licensed accounts on our Jira Software Cloud site. They have access to a specific project as intended, but we've noticed they can also see our full internal user list in places they shouldn't.

Issue 1 — Assignee filter dropdown

In the "All work" view (new Jira UI), when a user clicks the Assignee filter button, a dropdown appears listing all users on the site. External customers can see all internal team members there. We want to hide this user list from them.

Issue 2 — Assignee column in the table

Even if we solve the filter dropdown, the Assignee column in the issue list still shows internal team member names inline for every issue. Is there a way to hide or restrict that as well?

What I've tried / what I know

• For Issue 1, I believe removing the Browse users and groups global permission from the external customers' group should stop the user list appearing in the dropdown. Is that correct?
• For Issue 2, I'm not sure if there's a native way to hide a column for a specific group of users, or whether Issue Security / Permission Scheme changes are the right approach here.

Questions

1. Is revoking Browse users and groups the correct and complete solution for the Assignee filter dropdown, or are there side effects I should be aware of?
2. Is there a supported way to hide the Assignee column (or mask the values in it) from external users in the "All work" view, without affecting internal users?

   Environment

   Jira Software Cloud (new UI)
   External customers have licensed user accounts (not portal-only)

[Philipp Sendek _catworkx_ · Accepted solution]

Hi @Ivan Andrieiev ,

you were already on the right track with limiting the permission "Browse users and groups". However, this merely limits the selection of all users in dropdown fields. Wherever people are already set - such as in the Reporter or Assignee field - you cannot hide it from those users.

The moment you add external users as licensed users, they're "normal" users to Jira and are allowed to see everything that's not limited by the available permissions and restrictions.

That being said and without knowing your exact requirements for workin with external users, I would recommend to have a look at the guest account feature in Jira: https://support.atlassian.com/jira-cloud-administration/docs/manage-guest-access-in-jira/

Maybe this helps solve your issue while still allowing external users to collaborate in your projects?

Guests are designed to be siloed and "kept away" from sensitive and internal information and were introduced for cases like yours.

I hope that helps.

Greetings
Philipp

[Marc -Devoteam- · Accepted solution]

Hi @Ivan Andrieiev 

"For Issue 1, I believe removing the Browse users and groups global permission from the external customers' group should stop the user list appearing in the dropdown. Is that correct?"

This will limit the list of assignees, but this will also mean the users from that group can't access the space anymore.

"Is there a supported way to hide the Assignee column (or mask the values in it) from external users in the "All work" view, without affecting internal users?

Environment"

No there is no way to hide the assignee field on issue when searching if user have been granted a Jira license and have browse permissions to a space. Even granting guest license and add the guest group to a space won't limit this.

[Shalini Pradhan]

Hello @Ivan Andrieiev ,

Good day! Welcome to Atlassian Community :)

Yes, you are right. Removing the "Browse users and groups" global permission from the group those external customers belong to is the right approach to stop the full user list from appearing in the Assignee filter dropdown.

Once you do this, the external users will no longer see the full site user directory in filter dropdowns (Assignee, Reporter, add watchers, any user picker field etc.). They will still be able to see users who are directly involved in issues they have access to (for example, the assignee or reporter on an issue they can view) this cant be avoided.

Some side effects:

• They wont be able to mention other users in issues, or comments etc.
• They wont be able to search for users/groups to share boards and dashboards with

Currently, there is no native way in Jira Cloud to hide a specific column (like Assignee) from certain users in the "All work" / list view.

Thank you