Apologies for my mistake cc4eb0e5a6ce and e6207b92a2be I linked to the wrong issue. This is the one I think is a duplicate: JRACLOUD-40963 – User picker (multi user) user filtering feature

Do you agree that this issue duplicates JRACLOUD-40963?

Yes, this is a separate feature request. I agree with Julia Foden.

HI Anusha

It appears that JRACLOUD-36896 is about the system fields Reporter and Assignee and about the users available to @mention.

This ticket is about Multi-User picker custom fields. 

If you want to close this one in favour of the other you should at least update the description of the other one to include Multi-User picker custom fields

As mentioned above, I believe this issue might be a duplicate of JRACLOUD-36896 – Limit User Picker to members of certain groups/roles in System Fields

I recommend that watchers of this issue vote on and watch the above issue. So that votes aren't split, I believe this ticket should be closed, but I will wait a week before taking any action in case anyone thinks both issues should continue to exist. Thank you!

Dear Atlassians,

with all due respect to you and your amazing work, from our point of view this should not be a mere feature request. It should be reconsidered as a big bug.

There are many similar reported issues (probably causing a fragmentation of votes) which proves in a way how big privacy concern it is.

• Suggestion: Don't show users (or Portal Only Customer) who doesn't have Jira application access to appear on reporters and project roles list (59 votes)
  https://jira.atlassian.com/browse/JSDCLOUD-10055
  Created 10/Mar/2011 2:03 PM

• • It is creating panic among our teams that clients visible in the Reporter field and if selected may provide clients access to our internal discussions, work, etc.

• Suggestion: Limit User Picker to members of certain groups/roles in System Fields (312 votes)
  https://jira.atlassian.com/browse/JRACLOUD-36896
  Created 07/Feb/2014 1:55 AM (related JRASERVER-7659: 16/Aug/2005 4:13 PM)

• • The typical problem with the "Browse Users" permission is that we, and many others, invite external users (project partners, customers) to their JIRA projects, but cannot give them this permission, as that would disclose other customers/partners one is working with.

• • It is a big issue and seems like a problem for GDPR that even if you don't have access to another Jira project you can see that project's customer's personal information (name and email address).

• Suggestion: Restrict Reporter Field to only users with Create Issues Permission (51 votes)
  https://jira.atlassian.com/browse/JRACLOUD-42446
  Created: 13/Mar/2015 1:38 PM

• • Dangerous - it breaches privacy where issue content is shared in an email notification to the new "reporter"

• • Confusing - the new "reporter" doesn't understand the reference/relevance to their product support

• • Time wasting

1. 1. 1. the "reporter" wastes their time in alerting us of the error in selecting the wrong reporter, and

1. 1. 1. it wastes our time to understand what has happened and how to appropriately resolve the reporter used in error, and

1. 1. 1. it delays the issue resolution if the SD Team member is trying to get further information from who they assume is the intended reporter to fix the issue. *Especially if the issue is a P1 or P2 these delays could be very bad.

• Bug: Customer without permission to project can be added as a reporter of a request (7 affected)
  https://jira.atlassian.com/browse/JSDCLOUD-8649
  Created 28/Nov/2019 12:27 PM (probably much more earlier according to issuekey)

• • Exposes customer contacts to any Jira user on the system.

• • External customers could be accidentally associated with others tickets not remotely related to theirs

• Suggestion: Customers shouldn't be suggested on User Picker custom fields on non-Jira Service Management projects (19 votes)
  https://jira.atlassian.com/browse/JRACLOUD-76780
  Created 07/Jun/2021 4:08 PM

Maybe more.

Yes, +1

I agree with the suggestion to enable user filtering on multi user pickers. As well as excluding JSM customers, it would be useful to be able to specify which groups of internal users are available, the same as on single user pickers.

alternative suggestion could be - apply also a user filtering as this is the case for single User Picker. By using one of the default groups, e.g. jira-core-users one could obtain the same result (to exclude customers unless they're not assigned to this group - I assume).