Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Earn badges and make progress

You're on your way to the next level! Join the Kudos program to earn points and save your progress.

Deleted user Avatar
Deleted user

Level 1: Seed

25 / 150 points

Next: Root


1 badge earned


Participate in fun challenges

Challenges come and go, but your rewards stay with you. Do more to earn more!


Gift kudos to your peers

What goes around comes around! Share the love by gifting kudos to your peers.


Rise up in the ranks

Keep earning points to reach the top of the leaderboard. It resets every quarter so you always have a chance!


Come for the products,
stay for the community

The Atlassian Community can help you and your team get more value out of Atlassian products and practices.

Atlassian Community about banner
Community Members
Community Events
Community Groups

Can Security Levels work to limit visibility of issues in the Service Desk portal?


I have a Service Desk portal - with issues separated as expected using Organizations.  I also have customers that access the same issues through JIRA (not the service portal), using Security Levels to limit their issue access.

My question is, is the Atlassian plan to use Security Levels somehow with the Service Portal or should the Security Level and Organization be thought of as completely separate security models (one for JIRA and the other for SD)?  

I am currently taking advantage of the feature (bug?) ..  that removing "Service Desk Customer - Portal Access" from a Security Level, removes access for all portal users, except those that have access to the Security Level.   This could both be considered as a feature and a bug ... :)

1 answer

1 accepted

1 vote
Answer accepted
Andy Heinzer
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
Sep 18, 2017

Think of them as completely separate security models, because they are.   I can understand why you might consider these to be similar, they do provide similar functions within JIRA.    But the documentation on Customizing JIRA Service Desk permissions explains what this Service Desk security scheme does.  From Customizing Jira Service Desk permissions:

In addition, if the service desk project uses an issue security scheme, make sure that it is configured so that service desk users can view issues. Otherwise, customers might be able to create issues but not view them after they've been created. See Configuring issue-level security

By default, no projects in JIRA automatically use an issue level security scheme.   Not even Service Desk projects.   But Service Desk projects do have a way to separate access to issues for Service Desk customer only users.  These users only have access to the customer portal, which in turn is only showing issues that they are the reporter, or where they have been added as a requested participant, or possibly issues that have been shared with their organization.

Yes I believe you could further restrict user access to specific issues in the customer portal with an issue level security scheme.  But I'd recommend being careful with doing so.   I could foresee scenarios where customer portal only users might be able to create issues, but then never see them because they lack the security level assigned to the issue, or possibly they could be prevented from creating issues altogether.

I have an issue security scheme applied to a service desk project. Dependent on which options the user select at Create, a certain security level will be set in a post function so that only certain agents will be able to see the ticket. Besides, the security level also gives access issue to "Service Desk Customer - Portal Access"

A ticket is created with the correct security level, and the customer user is provided a direct link to the issue in the portal, and the user has access to the ticket. The "Requests" count at the top right increases with one. However, when viewing the requests list, the new ticket is not listed. The same behavior also applies to request participant. 
Email notification is also sent to the customer user.

Assuming that it is a bug that the ticket is not listed.

Service Desk version is 3.16.1

Hi Peter, 

i m applying the same solution but i can see all requests. so i dont think it is a bug... or maybe it was a bug :) 

Like David Wolfman likes this

Does your solution work with organizations?
I mean can members share their requests with other members of their organization?

Suggest an answer

Log in or Sign up to answer
AUG Leaders

Atlassian Community Events