Block customer portal for specific customers

[Daniel Sidler]

This is a tricky one. We run a JSM project for external customer support. We set up customers and organizations and allow access to the portal (and via email) only on invitation. This works perfect for the majority of customers.

Now there's one customer organization that for compliance reasons won't allow their users to access the customer portal. They only allow their staff to create issues via email. 

Is there a way to manage portal access per customer, without affecting their ability to create issues via email. All within the same JSM project?

I'm aware of Atlassian Guard, which would enable us to delegate user authentication to an external identity provider (e.g. Entra ID), where I could block certain user accounts. But this seems overly involved, and disruptive for the majority of our other customers. Besides, it requires additional licensing. 

Any hints are appreciated! 

[Marc - Devoteam]

Hi @Daniel Sidler 

You could create a group for all customer, excluding the customers from this client.

The set restrictions on each request type that only that group can see the request(s).

If a user from the specific customer reaches the portal, they will not see request types.

There are no options to manage portal access per user or group, not even Guard.

the IPD settings in guard for JSM allow you to connect with external IDP's to have external user to make use of SSO with their company account.

[Daniel Sidler]

Hi @Marc - Devoteam 

Thanks for your reply. This sounds like a workaround we could look into!

As for SSO via Guard, I think this could still work. I basically would configure my external IDP to show the finger to users from a certain domain. This would prevent them from accessing the portal but still allow them to use email, or not? 

[Marc - Devoteam]

Hi @Daniel Sidler 

Yes, they could you the email option, but they wouldn't be able to view their open request on the portal.

As this setup will prevent this, as they can't login.

Also if the users use their own email domain, you would need to get in contact with the customer to connect their IDP to your Guard.

[Daniel Sidler]

Yes, it would completely lock them out of the portal, which is basically what they want.

Nevertheless I will follow-up your suggestion of using request type restrictions, as it seems less complex overall. While it still would allow customers to log onto the portal, they would not see anything. Here's hoping they find this an acceptable compromise.

[Marc - Devoteam]

Hi @Daniel Sidler 

Please accept my answer as a solution, if my answer helped to solve your request.

This will help other community member trying to solve the same.

P.S. If the answer is very valuable to you, please share some kudos.