Some mails from customers are added as internal comments

[Dominik Kaźmierski]

Hello Atlassian Community!

I am experiencing an issue with incoming emails from our customers. Specifically:

1. Some emails are added as internal comments, even though our permission scheme does not allow customers to create internal comments.
2. After such emails are processed, I often receive an additional comment saying: "Reporter does not have permission to create attachments." However, our permission scheme explicitly allows reporters to create attachments.

See the screenshot below:

Additionally, I’ve noticed another issue related to mentions:
When a customer is mentioned in a comment and replies to that mention via email, their response is rejected by the mail handler with the message: "User (...) does not have permission to comment on an issue in project (...)." This behavior also contradicts our permission scheme.

Do I need to add customers as request participants to resolve these issues?

Should I escalate these problems to Atlassian Support?

Thanks for your help!

[Marc - Devoteam]

Hi @Dominik Kaźmierski 

Are there any automation rules active, that might trigger this action.

The point @Jack Brickey makes is also something to check.

What does your permission scheme look like?

On the attachment create permission, is the option Service Project Customer - Portal Access provided.

This is required for non Jira users (customers)

[Dominik Kaźmierski]

Hi @Marc - Devoteam
Thank You for your response.

We do not have any automation rules related to attachments or the visibility of comments. In the issue shown in the screenshot attached to my question, there are only three automation rules in total:

1. Copying people from watchers to request participants (triggered after the first transition).
2. Assigning a value to one custom field based on the value of another custom field (also triggered after the first transition).
3. Changing the issue status from "Pending" to "Work in Progress" after receiving a comment from the request creator. (This rule has not been triggered.)

I have attached screenshots of the permission scheme in my response to Jack’s comment below.

[Marc - Devoteam]

Hi @Dominik Kaźmierski 

Any rule action on the project can have in the config an action to set this, it's best to check all rules.

No global rules or rules active in the legacy automation section?

[Jack Brickey]

I wonder if some of your customers also have Jira user licenses and have browse/comment permissions.

[Dominik Kaźmierski]

Hi Jack, thanks for answer!
Person from attached screenshot is a customer without a paid license:

His first mail reply was added as 'Reply to a customer' comment and the next two replies were added as 'Internal notes' (see the screenshot attached in my question).

As a customer he has both browse and comment permissions (Service Project Customer - Portal Access):

The same thing goes to the Attachments permissions: