https://getsupport.atlassian.com/browse/PCS-320652

Is there any workaround for JSM projects? All our users are able to see portal-only users by starting an @-mention. This is not acceptable as this way, people can enumerate a lot of mail addresses they are not supposed to see.

+1 Additionally to G's Comment this issue was closed because there is a solution for Cloud but this is still a huge problem in DC.

Hi 23ef3e30d63c, the one big gap that still remains is that there is no control over portal-only customers and that is a big problem for JSM projects. As mentioned in my comment here, we cannot take away the Browse Project permission from the Service Project Customer - Portal Access or it breaks the project. These portal-only users never need to be at-mentioned at all since they cannot receive those notifications and so it is very misleading to users that are at-mentioning these people and they are never receiving the notification.

Request Participants and the Reporter also need different treatment/restrictions in JSM projects since they are really only meant to receive emails from public comments.

The below might be the solve:

• Portal-only customers should never be allowed to be at-mentioned
  • If the permission was separate from Browse Projects, we could make this happen... right now we are blocked (but they should be prohibited from at-mentions by default)
• Atlassian accounts can never be at-mentioned in public comments unless they are not listed in the Request Participants nor the Reporter user fields
  • I can see a use-case for at-mentioning someone not listed in those user fields on a public comment to loop them in for just that comment
    • should only allow the people that can browse, so that aligns with the new setup
  • I can also see a use-case where maybe in an internal comment you want to at-mention just a single Atlassian account that is one of the request participants (they might need to know something that the rest of the participants should not be notified about)
  • But if it is simpler, prohibiting users in these fields from being at-mentioned all together is better than today where they get duplicate emails on public comments

So seems like there is still work to be done here and this should be reopened. Thanks!

Hey 625e53328cfc thanks for your comment. I want to clarify one point:
 

We want people on a project to be able to see and reference other users on that project but not necessarily everyone on Jira or on other projects.

That's how the new functionality works. If a user does not have the Browse Projects permission in a specific project, they will not appear in @ mention the dropdown on issues within that project.

Thanks @23ef3e30d63c, no i don't think this helps. The problem is that for many Jira users, we don't want all of our project users seeing all of our projects. We want people on a project to be able to see and reference other users on that project but not necessarily everyone on Jira or on other projects.

Eg one project might be for CokeCola and the other project might be for Pepsi (just as examples).

The product has changed since this ticket was created. In order for a user to appear in the @ mention dropdown now they must have the Browse Projects project permission of a company-managed project. Does this satisfy the requirements of the watchers of this ticket? Thank you!

The watchers of this ticket may be interested in this post: Improvements to Browser User permissions (User Searchability by Project). Please add any questions or comments there.

Pretty sure Atlassian is not even paying attention to this... It's been years... I implore everyone to reach out to Atlassian directly and highlight the need to have this issue fixed.