Defining 3rd party (external users) and granting right access to keep company data confidential

Question

I am managing and handling Jira and JSM products.

Requirement is to define some external users (Contractors) to a single JSM project Support where internal users (Company) and external users (3rd party) collaborate and work together on tickets. External users(or their respective group) should have only access to that specific single project, their assigned issues and specific Project Dashboard configured for their group only. Some users can create issues and some can close and rest only can work when assigned to them.

ATM, I have defined them in Users for Product JSM with product role User and added them in a separate group e.g. Contractor. This group has Group product access to JSM with Product Role as User(Agent).

There are multiple groups defined for different Contracting Companies.

I have also defined a Project Role: Contractors and added the group as one of the default groups.

Now in JSM Project Support,  I have added Contractor Group under People and Access with Project Roles as shown in screenshot (I am not sure if I need the group to have project role Service Desk Team or only Contractors will suffice).

The reason for adding under a project role Contractors to use multiple contractor groups to minimize effort of adding them separately under each part of Permission Scheme (a dedicated permission scheme for Project Support).

One issue I am experiencing, if not selecting project role Service Desk Team under permission scheme i.e to create/edit issues, JSM raises each time an error as shown

I want to handle ticket processing using Project Role Contractors.

Defined issue security scheme as shown

The problem is I am still getting complaints that some contractor users are still able to see other projects or all issues either from filters or from Dashboard.

On Dashboard, I have defined the specific Contractor group to be viewer.

Any opinion is welcome and will be considered an opportunity for me to be good learner to implement correctly.

Marc -Devoteam- · Answer

Hi @Habib Memon

Make use of a Security Scheme in the related JSM project.

Set security level and set a level for the agents from the 3rd party to only be able to see issues, with a specific security level.

See the link in @Mikael Sandberg reply.

Mikael Sandberg · Answer

The thing that you are missing is that you would also need work item security if the contractors should only have access to work items that are assigned to them. You can learn more about it here.

You can just add them to the Service Desk Team project role if you have work item security set up correctly. If you want to keep the Contractors role you have to map that role to the same permissions as Service Desk Team in order for them to be able to perform the same thing as your internal agents.