Hello All,
We have a requirement to restrict external users/domains (e.g., gmail.com) from raising requests via both the customer portal and the email channel in Jira Service Management.
We tested the following configurations:
Email channel allowlistProject settings → Channels and self-service → Email → Manage allowlistHowever, even when a domain is not added to the allowlist, users are still able to create tickets via email if they are allowed under Customer Access.
Customer Access – ExternalCustomer access → External → Only allow account creation for customers with specific email domainsWhen domains are allowed here, users can create requests via both portal and email, regardless of the Email allowlist configuration.
This raises a couple of questions:
Looking for clarity on the expected behavior and best practice for this use case.
Thanks in advance!
Hi @Pavankumar Machireddy ,Customer Access domain restriction is the correct setting to enforce this use casefollow customer Access > External > allow only specific email domains to controls who can raise requests through both the portal and email.Basically Restrict domains in Customer Access and, if needed, use the email allowlist/blocklist only as an additional email-channel control.
Hello @Pavankumar Machireddy
From what you described, your understanding is basically correct.
The Email channel allowlist is not the setting that decides who is allowed to raise requests in general. Its purpose is to make sure emails from trusted domains are never filtered out by the email channel. The opposite control for email is the blocklist, where messages from listed domains or addresses are always filtered out.
For your second question, I would say Customer Access / Channel access is the effective controlling setting for who can create requests through portal and email. Atlassian’s current JSM docs say that channel access controls who can send requests through the portal, widget, and email, and the customer access settings also control whether customers can create accounts by sending an email request. That matches the behavior you saw in testing.
So for your third question: yes, if your goal is to restrict external domains from creating tickets through both the portal and the email channel, then configuring Customer access → External → only allow account creation for customers with specific email domains is the right primary approach.
Great explanation @Arkadiusz Wroblewski Thanks!
Thanks for clarification! @Himanshu Tiwary
Hi @Pavankumar Machireddy
Your understanding is right. In JSM, the email allowlist doesn’t actually control who can raise requests, it only affects how emails are handled. So if a user is already allowed through Customer Access, they can still create tickets via email even if their domain isn’t in the allowlist.
To properly restrict external domains, the correct setting to use is Customer Access -> External -> allow only specific email domains. This controls access for both the portal and email. Just keep in mind that users who are already added as customers can still raise requests, so you may need to remove them if you want to fully enforce the restriction.
It looks like you're new here. Sign in or register to get started.
