Self Service for managing customers in an organization

[Olaf Doemer]

We use Jira Service Management Cloud for our Client Support team and we have a Support Portal for our clients to create tickets for us. The portal does not allow anonymous ticket submission. 

Our Agents and Admins are currently in charge managing the organizations and customer contacts in those organizations. 

I would like to find a way to open the administration of organization and contacts to specific individuals in our client's companies. 

Let me try to put this in an example:

• Company ACME is a client of ours.
• In our JSM project we have an organization called "ACME"
• This organization "ACME" has a number of employees ("customers" in JSM terminology) that frequently log into our portal and are opening tickets for us.
• Lisa is the IT Manager in company ACME and is one of these individuals.
• I want to make Lisa responsible to add and remove her coworkers portal access. This way she is in charge and can remove people that might have left ACME or add new colleagues. 
• I would like to find a way to flag her as admin and enable her for this access management.

Maybe there is an App in the marketplace that I just have not found yet. Or maybe I have to build my own Identity provider service and manage that outside of Jira Service Management. 

I would be grateful for any ideas or pointers.

Thank you!

[Rob Mkrtchian _CAIAT_US_]

I think the only way to allow the customer manage customers is creating a role, assigning "administer Jira" permission and assigning that role to that IT manager customer... but with that they will get whole bunch of other permissions as project admin...

[Olaf Doemer]

Thanks a lot. The permissions are the challenge. I have been thinking about building something using these APIs

https://developer.atlassian.com/cloud/jira/service-desk/rest/api-group-organization/#api-group-organization

I would like all external Support Portal users to not have visibility into anything but their own organization members.

[Rob Mkrtchian _CAIAT_US_]

It must be feasible. API has add users to org method. It is also possible to create a private Forge app, and have it up and running quickly, but in that case you should give an access at least as a user with no admin rights to your client admins. Imo Forge option is easier, because data will not leave your Jira instance, and you will not need to deal with new authorization service for your clients.

[Brian Hill]

The API has limitations evident for delivering this. The user needs to be an equivalent of a JSM Agent, but the scenario you're describing would benefit from having a lower level permission that works more like an organisation agent, responsible for self-maintenance of the Organisation+Customers with no other JSM admin rights except perhaps maintenance of the Organisation and whatever custom attributes might be defined for it. Supportive of what you're looking to achieve here, but if the API scope doesn't have a permissions model that matches the need, it will need other ways to implement.