Create portal only customer

[Stefan Voogt]

How do i create portal only customers?
when i Add them via customers in the service project as I understand from the documentation.
I still don't get to see them as a portal only customer in the administration section?

[Jack Brickey]

Hi @Stefan Voogt , when you add the user via project/customers are they set to a service desk customer role in that project?

[Stefan Voogt]

Yes

[Bob Boursaw]

Hey everyone, 

The type of account the user receives when accessing/signing up for the portal is going to be determined by the customer access settings configured within your environment.  

Depending on the user having the same email as one of your approved domains and the access settings granting the JSM Customer role, then attempting to log into the portal for the first time is going to result in an Atlassian account being created and not a portal-only (help center) account.

There are a number of potential scenarios when it comes to portal access and customer access settings, so to circle back to the main question asked, for setting up a portal-only account, I'll share a configuration that will accomplish this.  For this example, I'll assume the following.

• The user attempting to access the portal does not have an Atlassian ID
• They do not have an email address that matches any approved domains that grant access (JSM Customer role)
• In the Customer Access Settings, under External, "Allow portal-only accounts to be created for new customers accessing the help center" has been checked
• Under Portal Access, Allow Customers to create accounts, has been checked

When the user first attempts to access the portal, they will be prompted to complete their "Help Center" account setup, as regardless of the "account" being an Atlassian ID, or a portal-only account, an account creation/validation process does occur when first accessing the portal.

In a situation where your customer access configuration grants the user trying to log in the "JSM Customer" role, this will result in an Atlassian ID being created for the user.

Thanks, all!

Bob

[Joerg]

Hey.

Late to the party, I know.

1. Will portal-only accounts be added to the customer access default group?

2. Why would I want users to create portal-only accounts when Atlassian accounts are just fine and more powerful?

3. So what happens if I set the approved domain "any domain" to JSM -> Customer role and also have the JSM config set to allow portal-only accounts, will it result in a full Atlassian ID account? Why would I want one over the other? What is the best practice? 

Your comment and the answers to my questions are what is missing from the UI and documentation. But tbh I wish it was all simplified, yet on the contrary we now have the centralized and original user management experience which seem to drift further apart. In all honesty, from my perspective portal-only accounts seem like just a confusing redundancy.

[P_D_ Foerster]

Well, I have the same problem while testing.

It doesn't matter if I (as JSM agent) create a customer in the service project > customers > Add customers or if they customer tries to sign-up himself the customer user gets an Atlassian account.

According to Atlassian's documentation Add a customer to a service project a portal-only account should be created:

A portal-only account is created for the customer in the service project.

However, this doesn't seems to be the case anymore at least not in mine.
I would be glad if this can be verified.

[admin-nwalter]

I have the same issue. Atlassian Support was of no help either because they kept referring back to documentation, which is at it's current state inaccurate. 

Now it is incredibly difficult to add externals that will only use the portal and be able to change their names, because Atlassian autonames the accounts for you. 

[Joseph Chung Yin]

@Stefan Voogt -

Same question as mentioned by Jack.  It is my understanding that users (customers) once his/her account is setup, they are defaulted to portal user-only - meaning they are called out in JSM project's Service Desk Customers role where he/she access the project via the portal to submit requests only.

Hope this also helps.

Best, Joseph Chung Yin

Jira/JSM Functional Lead, Global Technology Applications Team

Viasat Inc.

[Bob Boursaw]

Hey everybody!

There are a lot of moving parts related to customer access configuration and account creation.  The main driver of most of this will be what has been configured in the customer access settings (site level configuration).

That said, this all begins with the Customer Permissions set on the project itself.  If it's set to Restricted, the only way customers can exist for the project is if they are invited by an admin or agent.  If it's set to Open, then the site level Customer Access configuration drives things.

If you're using approved domains and you are allowing the "JSM Customer" role for that domain, and the user attempting to access the portal belongs to that domain, then this user will be added to your site and/or granted the JSM Customer role.  So in this situation, no portal-only account will be created and it doesn't matter if "Allow portal-only accounts to be created for new customers accessing the help center" is enabled under the External section.

If the user is not on your site, they do not belong to the approved domain that grants JSM Customer role, and you have create accounts enabled under the External setting, then a portal only account would be created, provided that "Allow customers to create accounts" in the Portal section is enabled.  This applies in the above example as well.

Other questions...

1. Will portal-only accounts be added to the customer access default group?

No.  The user must have an Atlassian account to be added to a group on the site, so if they truly have a portal-only account, they will not be added.

2. Why would I want users to create portal-only accounts when Atlassian accounts are just fine and more powerful?

You may not want your portal only accounts to have much power.  The key here is, portal only accounts do not/can not have "Product" access.  So that is one potential reason.  Portal only accounts are "typically" external to your company and don't show up in your user directory.  This keeps your "internal" customers separate from your "external" customers.

3. So what happens if I set the approved domain "any domain" to JSM -> Customer role and also have the JSM config set to allow portal-only accounts, will it result in a full Atlassian ID account? Why would I want one over the other? What is the best practice? 

This is answered in #2, mostly.  There are situations where a user can end up with a portal only account and an Atlassian account, and that's never a desired outcome.  In these situations, if you're good with the user existing on your site, then you would merge the portal only account into the users Atlassian account, as having both can cause some minor issues.

Which account type you choose to use is up to you/your situation.  Are the users internal to your company but don't require JSM product level access but need to access the portal for submitting requests?  Then Atlassian accounts, on your site, with JSM Customer role is the way to go.  

Are they external to your company and you don't want them to show up in the directory?  Then portal-only is the way to go.  There are lots of different scenarios that would drive someone to configure things one way vs. the other.  

Not sure how much this helps, but happy to dig into any specifics someone is interested in further.

Thanks!

Bob

[Joerg]

Thanks @Bob Boursaw 

If I understand correctly, barely anyone should have a use for a setup where "any domain" JSM access is set to "customer", as that would result in everybody getting an Atlassian account which would be added to the default customer access group, right?

In my mind the possibility of an Atlassian ID account and a portal-only account conflicting is odd. From the perspective of a single Jira instance, I understand the concept of a portal-account as being a customer type access level. But I do not understand why not just everybody has an Atlassian ID account as a central basis to manage any instance-specific portal-only permissions etc. It's difficult for me to accept the logic of the current solution especially because things are managed from different locations in Jira/Atlassian Admin and they are not documented well enough for even admins to fully grasp it, which to me additionally indicates that it is too complicated.