nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Is there a way to allow @mention without them being able to see All People?

Karen Wille

We have just migrated our JIRA to the new JIRA cloud version

Clients are in their own user group and when I give them permission to Browse projects and People in Global permissions they can @mention on issues BUT they also can go to the People Tab and search for all people and teams which is a Privacy issue.

There is no @mention permission on its own in the Global permissions it is tied to Browse.

So i have had to remove their permission on Browse as Privacy is a huge concern for any company these days - its data really.

Is there a way that I can let people @ mention people on their project without giving them extra access!

Surely someone clever has solved this before (and I am not technical).

Thank you!

Accepted answers

Nic Brough -Adaptavist-

I'm afraid Jira has a very flat user access scheme.

You can either see everyone, or you can't (and if you can't, you still can mention them, but you have to know their ids).

Although it's a flat yes-or-no, it would not make any sense to have "mention but can't browse" - if you don't want people to see the list of other people, they you absolutely don't want people to be able to get the list by typing things into a comment and seeing what the autocomplete gives back.

All comments

Nic Brough -Adaptavist-

I'm afraid Jira has a very flat user access scheme.

You can either see everyone, or you can't (and if you can't, you still can mention them, but you have to know their ids).

Karen Wille

Thanks for taking the time to respond. I had hoped that clients could just @mention anyone that is assigned to their project and not see any other People tabs or people not related to their project.

With APRA regulations and tightening security I don't want clients to see any other client data even if it is just their name.

They LOVE the @mention feature though so hopefully maybe there will be something in the future that is locked down to project permissions.

Jackie Stukey

I have just discovered this issue and it is impossible for me to accept as ok. Surely there must be a way in a project management tool such as Jira to not be forced to expose other client and developer information to each other but still allow them the absolutely necessary feature of tagging only other people in the project they have access to on tasks for easy communication.

Does anybody have guidance? Discovering that my clients can freely browse my other client's staff and development resources really knocked the wind out of me after years of trusting my Jira and Confluence environments for everything.

Nic Brough -Adaptavist-

What "issue"?

Jira lets you share your issues, so everyone can see the problems. What is wrong with "client A has a problem, not sure B does, but let's be open that they do"?

Philipp Reske

Hello Nic,

the issue is, that there are deployment scenarios, where this "openness" is not tolerable, e.g. from data privacy perspective, or simply from company policy perspective.

Example: Software supplier Awesome software Ltd offers a Jira installation to all their customers (B2B, no B2C). For every customer a separate project is being created where the following people can access

Account management from supplier
Technical support from supplier
Support staff from customer

Now I want to enhance the user experience for the customer support staff allowing them to mention my staff in comments. This at the moment is only possible by granting them global permissions, which then would also allow them to see/browse people from support staff from other customers. But it is against my policy, that they get access to contact details for other customer's person, maybe I do not prefer to disclose whom my customers are, but maybe also other customers do not want to be disclosed.

Philipp Reske

PS: it is also subject of this CR: JRASERVER-69026

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira

cloud

jira-software

permission

privacy

mention