How can we configure Jira to securely allow external user access to a single project?

[J.P. Mehlhaff]

We have several external customers that we work closely with, and we need a shared project to work together on logging bugs/features, aligning on priority, etc. We previously explored JSM but realized we need functionality only available in JWM or Jira Software projects. So, we are exploring alternative options to host a project and invite the external customer to it.  

Since we will invite external users into our instance, we want to be extremely careful about inadvertently sharing sensitive information through a project name, label value, or filter names. 

Has anyone successfully created this kind of implementation? If so, what are the settings/configurations that we need to implement to ensure that an external user:

• Can only view and access a single project, or specific projects that we control access to
• Can’t view project names in any form including issue filters, JQL
• Can’t view project names through search or browsing all projects in any form
• Can’t view label values in any form
• Can’t view filter names that other users in our instance have created

So far, we’ve not been able to figure out how to ensure that this test external user can’t see all project names in our instance. Even though the user can only access one project, the user can see all project names in our directory.

[Asha Goyal]

Hello @J.P. Mehlhaff 

There is similar requirement which was already addressed in the commuinty.

https://community.atlassian.com/t5/Jira-Work-Management-Questions/Can-JIRA-work-management-forms-be-sent-to-external-stakeholders/qaq-p/2388519

Kindly Accept and Vote if it helps and let me know if you have any other queries.

Thanks

[J.P. Mehlhaff]

Hi @Asha Goyal

Thanks for the response, though that post doesn't quite answer what I'm looking for. In our case, we've evaluated those options. Still, we need the external user to create issues, edit issues throughout its lifecycle (editing JSM forms doesn't work as we need), edit custom fields, and use JQL for filtering issues. 

It seems that providing the external user with full access to a project is the only option that provides the functionality that we need. Given that Jira has such granular permissions, we figured we could entirely silo a project from all data within our instance that is outside of that project. However, that is the assumption we're trying to validate.