ira Service Management Forms: Do Form Restrictions Also Restrict Attachment Access for Portal-Only C

Question

Hi,

I need clarification on attachment security and form restrictions in Jira Service Management Cloud.

My current configuration

* For Ex: We have 100 Jira Service Management portal customers, all of whom are unlicensed, portal-only customers.
* I have created an additional form and added an attachment field to it.
* I have configured the form restriction to allow only specific users to view the form.
* My requirement is that only 30 designated portal customers should be able to view the additional form and upload attachments. The remaining 70 customers should not be able to view the form or access attachments uploaded through it.
* Agents should still be able to access the attachments as required.

Warning displayed by Jira Service Management

When configuring the form restriction, I see the following warning:

"Restrictions set on this form won’t apply to attachments. Anyone with access to the work item will be able to see attachments."

Testing performed

I have tested the configuration using portal customer accounts, and the form visibility restriction appears to be working as expected.

However, I would like to confirm whether the attachment field is also securely restricted, particularly when other portal customers have access to the same work item.

Questions

* Are form visibility restrictions supported for portal-only JSM customers, or are they intended only for users with Atlassian accounts?
* If only 30 out of 100 portal customers are authorized to view the form, can the other 70 customers access attachments uploaded through that form?
* Does the warning mean that attachments are accessible to anyone who can access the underlying work item, regardless of the form's visibility restrictions?
* Is there a supported configuration that allows only the 30 designated portal customers to view the form and upload attachments, while preventing the remaining 70 customers from viewing or downloading those attachments?

I would appreciate confirmation of the expected behavior and any recommended security configuration.

Thank you.

Mihai_LeanZero · Answer

Hi @Venkat Jira Admin,

I can't find any Atlassian doc that says form restrictions take time to apply, so I can't call it expected behaviour.

The closest public reports describe a stale work item view after automation adds a form on a transition. Their workaround is a page reload.
https://jira.atlassian.com/browse/JSDCLOUD-19077
https://jira.atlassian.com/browse/JSDCLOUD-18587

On an affected request, check these in order:
1. Have an authorized user hard reload when the message shows. If it clears at once, it's probably that stale view.
2. Note whether it happens on the portal or in the agent work item view. Both tickets are about the agent view, so they don't cover the portal.
3. If a reload doesn't clear it and it only clears on its own, raise it with support with a request key, the user, and the times it showed and cleared.

I couldn't find any setting that gives access straight away.

Venkat Jira Admin · Answer

Hi,

I have created an additional form that contains only an attachment field, which is not linked to any Jira field. This form will be added to the request when it transitions to a specific status.

I have configured the form restrictions so that only a specific group of users can view and submit the form.

However, I have noticed the following behavior:

* After adding the additional form, unauthorized users are able to see the message "Only specific people can view this form."
* For a few minutes after the form is added, authorized users also see the same message (some times) instead of the attachment field as shown in the attachment.
* After some time, authorized users are able to access the form and see the attachment field as expected as shown in the attachment.

Could you please clarify whether it takes some time for the form restrictions or permissions to take effect after the additional form is added?

Is this behavior expected, or is there any solution to ensure that authorized users can access the form immediately without experiencing this temporary issue?

Regards,

Venkat.

Mihai_LeanZero · Answer

Hi @Venkat Jira Admin,

Yes, that message is the normal view for someone outside the restriction. The files aren't protected by it, though. The forms doc says the restrictions won't apply to attachments on your form, "meaning anyone with access to the work item will still be able to see them."
https://support.atlassian.com/jira-service-management-cloud/docs/restrict-who-can-view-forms/

Your group test doesn't cover the portal-only customers, because a group can only hold Atlassian accounts. Customer accounts still can't be named in a form restriction.

I tested it on a test site. A file uploaded through the form's attachment field lands as an ordinary attachment on the work item, and the customer API lists it on the request too. I didn't test a second restricted user.

To keep the 70 out, they have to stay off the request, so the separate request type with sharing off is still the way.

The message showing up for authorised users and then clearing isn't something I can explain. The nearest known issue, JSDCLOUD-18713, is about people added to a restriction after the form was already on the work item, and there the message doesn't go away.
https://jira.atlassian.com/browse/JSDCLOUD-18713

A support ticket with an example request key is the way to settle that part.