Space - notification and access to internal comments

Question

Hello. Recently a user who is in a Customers ojects limited access group, managed to see an internal comment posted only to the Our Company employees. He has also added himself as Watcher of this ticket. He got a notification and the comment by email.

I have logged in as external user and tried the same but couldn't reproduce.

This Customers at Projects is used for all our projects, the customers have paid Atlassian accounts.

Ciro · Answer

Hi there, I think that timeline might explains it. The comment email goes out when the comment is saved, with the visibility it has at that moment. Saved without the lock, it reached every watcher in full. Restricting it 7 seconds later hides it in Jira from then on, but it can't recall an email that was already sent.

The gap that makes this easy to hit: company-managed spaces have no default visibility for comments, so every new comment starts as visible to everyone and the lock has to be picked before saving. The request for a configurable default is JRACLOUD-9091 (990 votes, still Gathering Interest), worth a vote from your admins.

So your setup is fine: roles and permissions did their job, it was the order of save and restrict.

Gisele Wolff · Answer

Hello Josh and Shaik I am back here but with my company user. Thank you, this is really helpful.

To answer your question: it's a regular Jira space (a company-managed business space), not a service space. Internal comments are restricted to the project role " Employees" (the lock icon), so your point 2 applies.

Here is what we have tested so far:

* Permission helper (The customer user, the work item, Browse projects): he gets access only through the project role "Customer in Project". He is not in the  Employees or administrators groups.
* His groups in admin.atlassian.com: Customers in Projects, jira-software-users, goal-users-dataloy-cloud and project-users-dataloy-cloud. Not  Employees.
* People page in the space: he only has the "Customer in Project" role. The " Employees" role is held only by the  Employees group, and it is not ticked for him.
* Permission scheme (Default Permission Scheme): Browse projects is granted to the roles atlassian-addons-project-access, Customer in Project and Guest - Collaborator, and to the groups  Employees and administrators. There is no issue security on the work items.
* Notification scheme (Default Notification Scheme, shared by 180 projects): "Someone made a comment" and "A comment is edited" both go to All Watchers, Current Assignee and Reporter. The customer user is a watcher on the work item.
* The exposed comment: it shows as "edited". According to the API it was created at 12:48:14 and edited at 12:48:21, only 7 seconds later. It is now restricted to  Employees. The most likely explanation is that my colleague saved it without the restriction and then edited it to restrict it to  Employees, so the notification had already been sent with the full text. His earlier comment on the same work item was restricted from the start and was not edited.
* Test account: my external test account is a licensed Atlassian user, in the same group and with the same "Customer in Project" role as himself. Logged in with it, I can't see the restricted comments in the work item view.
* Watchers is in the notification schema, so it is just correct he received the notification.

So it looks like permissions and roles are correct, and the exposure came from the comment being restricted after it was first posted. I think I will rest this for now.

Removing Browse projects or Jira access for the customers isn't an option, as this is a shared onboarding project where they work with us.

Thanks again,

Gisele

Shaik Riyaz · Answer

Hi Gisele,

Root Cause:

Because the "customer has a paid Atlassian account" and their group has internal access (such as the Browse Projects permission), Jira treats them as an internal user rather than a portal-only customer.

Issue Watcher: With internal access, they opened the ticket in the Jira issue view (/browse/KEY-xxx) and added themselves as a Watcher (portal-only customers can only be Request Participants, not Watchers).

Notification Scheme Triggered: Adding an internal comment suppresses customer portal notifications, but it still triggers the project’s standard Jira Notification Scheme for Watchers.

Solution:

* Remove the customer from Watchers on the issue.
* Update the Permission Scheme: Ensure external customer groups do not have Browse Projects permissions.
* Use the Portal: External users should only access tickets through the Customer Portal as Reporters or Request Participants, where internal comments are strictly hidden.

Thanks!!