How do I allow 1 external user to see only 1 of my many service desks?

[Graham Chilcoat]

I have about 15 internal service desks. I have 1 external user that needs to see 1 of those service desks.

I've turned on "Allow portal-only accounts to be created for new customers accessing the help center" and added their domain to "Only allow account creation for customers with specific email domains". In doing so this 1 user can see all 15 service desks because I have "Anyone allowed on the customer access settings", but If I change this to "Customers added to this service project only by agents and admins" I have to add all my internal users to the 15 service desks, and add any new employee that is onboard to those servers. That doesn't seem right am I missing something? This can't be how this works. 

[Judd Garratt]

Hi Graham,

Permissions can get quite confusing, I hear you! You're right that switching to 'customers added to this service project only by agents and admins' is what you need. That does mean your internal users will have to be added to the other 15 service desks, but you can use customer organisations to make this easier.

1) Add all internal users to a customer organisation and then add that organisation to each of the 15 service desks. Organisations can be used across multiple projects, so you'll only need to add the users into the organisation once and they'll gain permission for every service desk that the organisation is added to.

2) There's not yet a way to automatically add newly created users to an organisation, but this soon-to-be-released feature is worth watching as it may add this capability: Email domain organization association

As a temporary workaround, you can:

• Create a new service desk, set to 'anyone allowed on the customer access settings', with a single 'get access' request type.
• Add the automation rule described here: How to add Jira Service Management customers automatically to Organisation based on reporter email domain. This will automatically add users to the correct organisation based on their email domain when they raise a request in this service desk.
• Add a step into new employee onboarding to raise a request in the service desk above to get access to all the 15 internal service desks (this could be a manual step or automated as part of email creation for new employees if email requests are turned on for this 'get access' service desk).

It's not a perfect solution, but it'll work while we wait for the new feature linked above.

Good luck!