Grant internal employees with specified domain access to jira service management

[Claude]

Hi all,

I have set up a new JSM Help Center. The portal is accessible to all (public) without needing to log-in. However strangely enough internal company members do not have access to it. I have now also added internal customer access by checking the "use approved domains to grant internal customers access" and added our company email domain, but strangely enough they still don't have access. 

What is missing?

[Marc - Devoteam]

Hi @Claude 

Enabling this setting applies to New users/customers.

So for already existent users, add this group to the project and grant them the role Service Desk Customers, of you kept the permission scheme default.

Or you can add, the users via their email address via the customer option in the project.

[Claude]

Hmm that seems so strange. It's so counterintuitive that literally everybody has access to the help center, except for internal users.

If I decide to add the whole company to the "service desk" do they all get a spam invitation email to the product or project?

[Claude]

Hi @Marc - Devoteam ,

I have added all internal atlassian jira users to the "service desk team". They now have access to the portal but when my agents, want to add some of our internal employess as request participants to a ticket they can't do so. According to this link (https://confluence.atlassian.com/jirakb/agents-can-t-add-customers-to-jsm-cloud-projects-1295815386.html), this is limited to site or org admins. I myself was able to add these internal users to the ticket (since I'm site admin).

How can I give my agents the same rights so they can add internal users as request participants?

I'm also not the org admin so I couldn't verify this "approved domain" part. I know I have it checked but if I want to check the details only the org admin has access. 

[Marc - Devoteam]

Hi @Claude 

They need the role "service desk customer" NOT "service desk team",

[Claude]

Hi @Marc - Devoteam ,

According to this documentation collaborators should have the "service desk team" role. That role is supposedly to be used for internal employee accounts.

I don't understand why it's so difficult to work with internal employee accounts.
So the solution really is to add them the "Service desk team" and the "service desk customer" role? Seems like a lot of unecessary extra roles to give just to have internal users access the Portal and use it as intended.

[Marc - Devoteam]

Hi @Claude 

Jira users can be "collaborators" ,this will grant them permissions to work on JSM created issues.

To get portal access Service Desk Customer role is required, this is all based on the ootb permission scheme when creating a JSM project.

of course you can change the permission scheme used and base the roles on permissions required.

[Claude]

Hi @Marc - Devoteam ,

I have now added individual users and jira user groups to the "service desk customer". Still they can't access the help center. What is going on? I don't know what else to do anymore.

[Marc - Devoteam]

Hi @Claude 

How are the customer permissions set?

What is the configuration of the permission scheme used in the JSM project?

[Claude]

Hi @Marc - Devoteam ,

I haven't changed much in the customer permissions. 
Do you mean these?

I didn't change anything in the Project Permissions. 
It's honestly really frustrating, how can this be so incredibly complicated. I have already set the Channel access to open. Everybody has access excep our own internal users. I just want to give them the ability to access the portal as well so they don't need to access it via incognito window...

[Claude]

To add on this I have found out something.

I have added the internal user group of all employees via the "add people" button and given that group "service desk customer" access. When I went to check some of those users individually in the user management in jira, I saw the "jira service customer" box is NOT ticket. So now my question is, why does adding people via "add people" in project settings to the customer role, not actually give them customer role in the jira user management settings???

[Marc - Devoteam]

Hi @Claude 

Project permissions are not related to Product permissions.

You can grat a user permission to a project, but if the user is not granted product access no access is granted.

This as product access has license implications (costs)

It's strange that by dealt all users in administration haven't been granted the customer role by default.

So now you have to add this on every internal user?

You could se if you can use the API to do this quickly.

[Claude]

@Marc - Devoteam 

Hi there, in user management "jira service customer" does not incur costs. Only "jira service agent" does. So it would be fine. Why do I need to give him product access, external users can access the portal just fine? Why can't my internal employees do the same. This is such complete backwards logic!

But my question is, why in the world does this page even exist if it literally does nothing! This page is completely useless because granting a person "service desk customer" role doesn't actually give him a customer role, doesn't give him access to the project and also doesn't give him access to the portal. It's literally broken:

[Marc - Devoteam]

Hi @Claude 

Here your perspective is wrong.

In Atlassian Administration users can be granted the role "Customer", if you add a user with this role to the project to the project role "Service Desk Customer", the user can access the portal.

If you don't then the user will need to be added as customer via the Customer section in the project or if the project is open the customer can sign up by going to the portal.

[Claude]

Hi @Marc - Devoteam ,

But it doesn't make sense that I need to FIRST give internal users product access. I also haven't given product access to external users. So why is this suddenly a requirement for internal employees?

"or if the project is open the customer can sign up by going to the portal.". This is also not true, because my employees can't even get to the sign up screen. They literally can't access the portal, so they also can't sign up.

The portal is open and accessible except for internals. Supposedly the "fix" is to give them product access? This doesn't make sense. Nobody should require product permission to access an "open" portal.

[Claude]

Also btw, I just heard from external customers, if they have their own Jira account, they face exactly the same issue.

Logically you can't expect me to add an external customer, from an external jira in my companies jira user management and give them Product permissions to Jira service management? That doesn't make sense.

[Nikola Perisic]

Hello @Claude 

When your internal users try to access the portal, what is the error message that they receive? Let's start from there.

[Claude]

Hi Nikola,
This is the screen they are shown. Mind you again, everybody else (whether logged in or not) can access. Only internal company users can't access it. I also haven't given those users access to the project yet. I didn't feel it was necessary because the whole portal is open to the public.