How to hide knowledge base articles for external CC recipients?

[Erik Vanderstraeten]

This is our set-up:

• We have a JSM project for internal IT Support.
• It's linked with a knowledge-base, such that we can share how-to & troubleshooting articles with our colleagues who need IT Support.
• Colleagues can send an email to our IT Support mail address, which will create a ticket in the JSM project.

We want to allow following scenario:

• One of our colleagues sends a mail to IT Support and puts an external party in CC
• This external party should stay informed (via email) when IT Support replies to the colleague (via a 'reply to customer' comment)
• They should also be able to reply to that notification email.
  Which should create another customer comment on the ticket.

The solution provided here is almost what we're looking for: Solved: How to keep CC recipients when reply on ticket? (atlassian.com)

The big downside in that set-up is: if that external party is added as Request Participant, they will also have access to our knowledge-base and to the portal (to log tickets).
This is a security issue as both the knowledge-base and the portal contain information that should stay within the company and not publicly accessible.

How can we keep the External Party in the loop, yet limit their portal permissions to only view the tickets they're involved in, but nothing else (no ticket creation, no kb-articles)

[Angélica Luz]

Hello @Erik Vanderstraeten,

Thank you for reaching out to Atlassian Community!

​​I saw that you created a ticket with our support related to the same question and they are already helping you, but I would like to share some details with you as well.

When customers are allowed to create their own accounts and the customer permissions on the project are set to “Anyone on the web”, if the customer adds someone as CC, an account will be created for this person and they will be added as a participant. 

The request participants receive notifications from the ticket and they also can view the ticket in the customer portal. If there is a Confluence space linked to the project, they can also see the knowledge base articles. 

Currently, it’s not possible to restrict the knowledge base to specific customers or organizations. If a customer is added to a project, they will be able to create tickets, view tickets shared with them, and also see the articles.

There are feature requests suggesting improvements for that:

•  Knowledge Base: Allow page restrictions to be assigned based on "Organizations" - similar to user groups
• As a Service Desk administrator, I would like to restrict knowledge bases access to specific customers
• As a JSD agent I'd like to restrict Public knowledge articles view

Please, click on vote and also watch to receive updates about the features.  

Kind regards,
Angélica