Hi Deb,
Yes, the user needs to have access to the site and have view permissions on the plan to see the data the shared report.
Jira issue level security is designed in a manner that a user must have the appropriate permission levels to access data for that data to be seen in any location, reports to view data will run permissions checks to verify the user has access before it can be viewed.
Also to restrict access to a report you can remove access to a report via removing permissions for that user at the plan level as covered in the "Sharing reports" documentation.
For sharing externally data needs to be exported to a static form such as PDF or CSV and sent as one off reports, In portfolio reports there is an option to export the Scope or Release reports that can be used to send data to the external partners as static data.
Regards,
Earl
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.