nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

How to restrict internal users to see only certain organizations' tickets?

Yura Hayrapetyan

Hi guys!

expected result: In Jira Service Management I want to allocate internal users into organisations so that each internal user can see and edit tickets that belong only to their organisation.

Current result: Internal users are not able to see tickets reported by them + the tickets of their organisation, instead they see only all other tickets created by other internal users from other organisations.

Steps I have already taken to solve this: I have created security levels in security schemes and chosen certain internal users that need to be included in automation.
Then I allocated each internal user to their corresponding organisation ( adding customers in organisations). Then I have created an automation (screenshot attached).

Please advise guys which parts I am doing wrongly or maybe I missed something?

Accepted answers

Mark Segall

Hi @Yura Hayrapetyan and welcome to the community!

Adding users to organizations should be sufficient. I would make sure that the project's permission scheme - Browse Projects permission isn't too loose. By default it should only be open to:

Project Role (Administrators)
Project Role (atlassian-addons-project-access)
Project Role (Service Desk Team)
Service Project Customer - Portal Access

If you have say, "Any logged in user" set here, that would be a big no no that would override any type of portal permissions that you're trying to establish.

Joseph Chung Yin

@Yura Hayrapetyan -

Welcome to the community. To supplement what @Mark Segall mentioned, one thing that you mentioned in your ask was "Internal users see and edit tickets" which I am a bit concerned - What do you mean by internal users? + what do you mean by edit tickets? In general, JSM issue editing are only performed by Agents (users with JSM licenses).

Please advise/clarify.

Best, Joseph Chung Yin

Jira/JSM Functional Lead, Global Infrastructure Applications Team

Viasat Inc.

All comments

Mark Segall

Hi @Yura Hayrapetyan and welcome to the community!

Adding users to organizations should be sufficient. I would make sure that the project's permission scheme - Browse Projects permission isn't too loose. By default it should only be open to:

Project Role (Administrators)
Project Role (atlassian-addons-project-access)
Project Role (Service Desk Team)
Service Project Customer - Portal Access

If you have say, "Any logged in user" set here, that would be a big no no that would override any type of portal permissions that you're trying to establish.

Joseph Chung Yin

@Yura Hayrapetyan -

Please advise/clarify.

Best, Joseph Chung Yin

Jira/JSM Functional Lead, Global Infrastructure Applications Team

Viasat Inc.

Yura Hayrapetyan

Hi @Joseph Chung Yin
Thanks for your quick reply. By internal users I meant agents indeed. I just managed to understand root cause of "agents do not see their own created tickets" which was resulted by the added security levels.
to sum up - I have added a,b,c,d agents (company employees) to x,y,z organizations (clients) under a common Jira Service Management project. But all agents can now see all tickets of the project. Instead, I'd like each agent to see/edit tickets only of the organization to which they belong to.

Yura Hayrapetyan

hi @Mark Segall
thanks for the prompt response. The permission scheme is not loose. it is set like you just described.

Mark Segall

Thanks for the clarity @Yura Hayrapetyan and nice catch @Joseph Chung Yin. Organizations are only meant for portal users. They have no impact on your agents. Agents will have access to all issues in the project by default.

You can go the route of issue level security, but you'll need to revisit your whole permission scheme. Here's a step-by-step on issue level security:

https://support.atlassian.com/jira-cloud-administration/docs/configure-issue-security-schemes/

Another option you may want to consider is setting up separate JSM projects for each team. It would probably be the easiest method for segmenting the work.

Joseph Chung Yin

@Yura Hayrapetyan -

Based on my understanding that Agents (by default) will see all issues within a project. I would recommend that you setup your issue security security level with individual level - one for each organization. Within those security level include only the specific agent that supports each organization.

NOTE - You should also need to check the customer permissions "Customer sharing" option associated with your project (via Project settings >> Customer permissions) to ensure that it is set to "Customer can search for other customers within their organization".

Hope this helps.

Best, Joseph

Yura Hayrapetyan

hi @Joseph Chung Yin @Mark Segall I have checked the automation and security levels, still the problem is not solved, can you please advise the further possible steps ? Thanks!

Yura Hayrapetyan

Thanks @Mark Segall and @Joseph Chung Yin , you helped to to solve the problem guys!

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

cloud

jira-service-management-cloud

jira-service-management