Adding customer to Project user can see another Project

[Francesc Juventeny]

Hello everyone,

I have created a Team managed project to which I have added a customer. Like these...

If I login as that customer, I can see the assigned project, but also this other one that I shouldn't be able to see.

This has the Service management type. Is it the same as Company Managed? Why can the customer see it?

If I go to the properties of this project, it doesn't have this option that Team managed projects do.

Is there something like this that I need to modify in the project that shouldn't be visible?

Thank you!

[Gur Singh Kaur]

Hello @Trudy Claspill ,

So in this case, what can we do to solve the issue? How can we change the service project type?

We have to provide a Jira access to an external so we have to assign him a "Jira" license, but, we do not want him able to see the "Customer Care Service" project.  

Regards,

[Trudy Claspill]

Hello @Francesc Juventeny 

When you see "Team-managed service management" as the project type that does mean the project is Service Management and uses the Team Managed architecture for managing permissions and customizations.

When you see just "Service management" as the project type that means the project is Service Management and uses the Company Managed architecture for managing permissions and customizations. For Company Managed projects there is not a Project Access setting like you see for Team Managed projects. Instead access to the project is based on the Permissions Scheme associated to the project.

Another factor to consider is whether the person you have added is only a Customer or your Jira instance or if they are also an internal licensed user of Jira. That would be determined outside of the Jira application through the admin hub (admin.atlassian.com) where licensing and general access to the products is managed. Elevated permissions are needed to access that information.

You provided this:

That sort of view would be visible only to a user that is not just granted Customer access to your Jira instance, but also has licensed user access to your Jira instance. Users who have only Customer level access would only be able to access your Jira to see the Customer Portal. The screen image you have shared in the Project list, which would require the user to have access to Jira as a non-customer also.

In that case the user's ability to see that project in that list is based on the Permissions Scheme associated with that project. It is set in such a way that the Browse Projects permission is allocated directly or indirectly to the user.

More information about Permissions Schemes can be found here:

https://support.atlassian.com/jira-cloud-administration/docs/manage-project-permissions/

Permissions Schemes for Company Managed projects can be managed only by Jira Administrators. But one of the features of Permissions Schemes is that the permissions can be granted to Project Roles, and the Project Admin can then grant users permissions to their project by assigning the user to a Project Role. If the user was not assigned to a Project Role in that project, then they may be a member of a User Group granted permission to view the project, or the project may be viewable by Any Logged In User, or by Public.

[Trudy Claspill]

Hello @Gur Singh Kaur 

You cannot change the Customer Care project type. That is not a feature available in Jira. If the project needs to be a Team Managed project you would need to create a new project of that type and move the issues to it. That can be problematic and result in data loss. Refer to

https://support.atlassian.com/jira-software-cloud/docs/migrate-between-team-managed-and-company-managed-projects/

You need to work with the Project Administrator and your Jira Administrators to examine the permissions configuration for that project and the assignment of the user to roles and groups. Through that examination they can determine what can be done to prevent the user from seeing that project.