Is it possible to create a guest user that doesn't count as a member of our organization?

[Tim Malpass]

Our previous method for creating guest users was to grant them application access through a specific group, and then only give that group access to the project they needed to see. However, we've discovered that new Next Gen software projects, by default, are open to everyone in our directory, regardless of group. Even if we restrict all of our current projects, this doesn't solve the default behavior of new projects being open to everyone. So what we need to do is create guest users that don't count as part of our company for permissions purposes, and thus don't have access to any new projects that might get created under the default permissions. How can we do this?

[John Funk · Accepted solution]

Hi Tim,

You can still control who can see the Next-gen projects by going to Project Settings > Access and update who can see the project.  

[Tim Malpass]

This wouldn't solve the problem of the new permissions being subtractive instead of additive. If a new next-gen project were created with the default permissions, any guest users would be able to see it. We deal with multiple clients from different companies and we need to be able to maintain security of different projects and minimize the risk of things being exposed to all users.

If there isn't a way to create guest accounts outside of the directory, is there at least a way to set the default security level for next gen projects to Private?

[John Funk]

What is the default for you when you create a new Next-gen project? Who is included under Access?

[Tim Malpass]

Ah I see. You have to choose the Access level when creating it.

This would be a training issue then, where we would have to make sure our project leads know to never choose Open or Limited when creating a new project. Barring the ability to restrict that at the admin level, I'm more inclined to turn off Next Gen Projects entirely for now, in the hopes that they'll be more secure later.

[John Funk]

Yes, I have it turned off for non Admin users within our company as well. :-)