How to limit what project and issues vendors can see and work with

PATRICIA MURPHY

We have a few vendors that we want to collaborate with using projects in our Jira instance.

Requirements:

Each vendor can only see the project and issues within the project we are collaborating with them in.

No Vendor can see all of the projects within our Jira instance.

 

What I have tried that has not worked.

Steps to create vendor restricted access
1	Created a specific vendor Role
2	Created a specific vendor group
3	Created a Vendor Restricted Permission Scheme Notes: I created a copy of our standard permission scheme then edited groups and roles. Examples Browse projects I removed "Any logged in user" and added Project Admins and Team Members Added the specific Vendor role to: Assignable user, Create issues, Transition issues, Add comments, etc.
4	Created a  vendor specific project
4a	Used the Vendor Restricted Permission Scheme
4b	Added the specific vendor group, assigned to the vendor role

I invited 3 testers outside of my org to the specific vendor group, when they logged in with their NEW Jira credentials, they can see everything, all projects all issues.

 

What step did I miss?

Do I need to change all of our standard permission schemes to replace "Any logged in user" with specific groups?

 

Help will be greatly appreciated.

Thanks

Pat

 

Trudy P Claspill

Hello @PATRICIA MURPHY 

You said you want the Vendors to see only a subset of your projects.

You said you created a new Permission scheme where you removed the Any Logged In User permission allocations, and added the Vendor specific role.

To which projects did you apply that permission scheme?

If you applied that only to the projects you want your vendors to see, and all the other projects still use a permission schemed that grants access to "Any Logged In User", then that permission scheme on those other projects is configured to allow the vendor users to see them.

To prevent your vendors from seeing projects you need to ensure that the projects they should not see use permission scheme(s) that don't grant permissions to 

Public
Application Access
Any Logged In User 

 

The vendors will be able to see any project where the Browse Projects permission is granted to the above.

You also need to make sure that the vendors are not added to any group or role that is granted the Browse Projects permission in those projects' permission schemes.

To give them access to the projects you do want them to see your use of a vendor group and vendor role is correct. That applies to the projects you do want them to see.

 

All of the above applies to the Company Managed projects in your instance.

 

Another thing to consider is whether or not there are any Team Managed projects in your instance.

Team Managed projects have an overarching Access setting in each project. The options are Open, Limited, and Private.

The Open and Limited options make the projects visible to anybody with access to your Jira product. To prevent the projects from being visible to the vendors the Access setting in each one would need to be changed to Private. With that setting only the users assigned to roles in the Team Managed project can see the project.