Improvements to Browser User permissions (User Searchability by Project)

[Amirbehzad Eslami]

Hi Community,

TL;DR – We are changing user searchability in Mentions, Assignee, Reporter, and other User Picker fields in Jira's Issue View to users who have the Browse Projects permission. This provides a way to restrict user search by project.

We are excited to announce the enhancements to the Browse Users permissions. We have received several requests to limit user searches to a specific project. This is an important capability when you want to collaborate with clients or contractors on a particular project but don't want them to search for all users across the Jira instance.

In Jira Software (JSW), users often utilise two mechanisms to keep others in the loop and collaborate on issues within a project:

1. Mentions: With this feature, users can ping members of their team by mentioning them in the issue description or comment. To mention someone, simply type "@" followed by their username.

2. Issue fields: Certain fields like Assignee, Reporter, and Watchers make use of a User Picker, allowing users to browse and select other users.

When using these features, an auto-completed list of suggested users is displayed as the user types in another user's name or email.

The ability to see other users in Jira is governed by the Browse Users global permission. As the name suggests, this permission is applied site-wide and affects the visibility of users. As a result, Jira Administrators face a limitation when setting user visibility—they can either allow users to see everyone or no one.

Based on your frequent requests, we are working on a new feature in Jira Cloud that will allow you to restrict user mentions and searchability by projects. In a couple of weeks, we will be introducing this change.

Once this feature is rolled out, you will be able to restrict user mentions by granting the Browse Project permission to specific user groups in the project's settings. These users with the Browse Project permission will be searchable during mentions and field assignment, while the current user is still unable to search for other users in other parts of Jira, thanks to the disabled global Browse user and groups.

We value your feedback on this feature, as it is currently under development. Please let us know your thoughts.

[Patrick Albrecht]

Thank you, this sounds like a very promising step and will help us to collaborate deeper with our customers as we currently simply remove all features from them where they could possibly see all users. As a current DC user, this will also help us to accelerate our cloud migration once we can see the feature in action.

[srikanth duggineni]

But with this , users atleast will have 2 limitations. Thorough testing needs to be done. 

1. They cannot browse the users in JQL - It means they have to go to Advanced JQL and user user email addresses. It means, users should know the email address of each user in the site. 

2. They can't change the Board admins to some other people. 

[Jed Fisher]

Thank you - this is needed

[Jed Fisher]

Please also see 

https://jira.atlassian.com/browse/ID-8129

[Greg D]

@Amirbehzad Eslami can you also remove the ability to at-mention the Reporter and Request Participants in JSM projects?  These users are falling outside of your new intended logic.

We cannot take away the Browse Project permission from the Service Project Customer - Portal Access or it breaks the project and so we cannot remove them from at-mentions (which serves no purpose in these projects... at-mentioning just makes it seem like someone was notified when they were not if you use it in an internal comment and it can double-notify on Reply to customer comments if the person does happen to have service desk team access).

In JSM projects, at-mentions should only be able to be used on people that are not in the Reporter and not in the Request Participants field and also can browse the project.

[Jeremy Bouffard]

Any updates on this ? Is it yet possible to filter the users show in the reporter dropdown ?

[Edie Hovermale]

@Amirbehzad Eslami

Any update on when this will be available? Thanks

[Derek Sheeman]

1. When?

2. When for Data Center?

[Sean Stokke]

This was supposed to be a few weeks from seven months ago.  We have a workaround, but it would be nice not to have to do this for each new project. A new expected release date would be nice.  

[Schal_ Thomas]

This functionality would be very important for us. Are there any news on this topic?

[Daniel Bagiński]

Hello, any news on that? 

I top this comment:

"This is also an issue for us because we have a lot of users in our Jira user directory that do not have JIRA access. It should never be possible to assign issues to them."

This is exactly what I am facing right now. I would like to limit user picker dropdown list for Assignee/Reporter and other user picker lists to a specific group or project.

[Majken Longlade]

A little late to the party. I believe restricting mentions has been implemented, and I actually don't want this. Mentioning someone does two things, it:

1. Alerts the user
2. Inserts a reference to a specific user including a link to their profile

We mention users in Slack all the time to make it clear who we are talking about, and have the same need in JSM projects "Doing x per Mike's advice" is a lot more useful when Mike is a link to the user profile.