Issue Summary

Find users API endpoint returns empty results for Service Accounts with credentials having scope read:email-address:Jira

Similar to https://jira.atlassian.com/browse/JRACLOUD-97123

Steps to Reproduce

1. Create a Service Account with Jira access.
2. Make sure the Service Account is a member of the group having "Browse Users and Groups" Global Permission.
3. Generate Access token for the service account making sure to include "read:email-address:jira" scope. Tested with following scopes (even though not all are required)

Read
read:application-role:jira
read:avatar:jira
read:group:jira
read:jira-user
read:user.columns:jira
read:user.property:jira
read:user:jira
read:account
read:email-address:jira
read:me
read:comment:jira
read:issue:jira
read:issue:jira-software
read:issue.vote:jira
read:issue.watcher:jira
read:project:jira
Write
write:user-configuration:jira
write:user.property:jira 

4. Call API endpoint:

https://api.atlassian.com/ex/jira/xxxxxxxxxxx/rest/api/3/user/search?query=test

 Make sure to replace query with some existing user name. Empty results returned:

[] 

5. Create one more API token with the same scope except "read:email-address:jira"

6. Call the same API endpoint using second token: Results will be returned.

Expected Results

Results are returned

Actual Results

Empty results are returned

Workaround

Currently there is no known workaround for this behavior. The closest available workaround is to exclude the scope OR use regular user scoped credentials.