How to Restrict Customer Visibility in Jira Service Management Using Customer Groups (2026)

Lead

Jira Service Management gives you four overlapping controls to segment who sees what: customer groups, request-type restrictions, request sharing, and work-item security. This guide walks you through setting up each layer so customers see only their own requests and agents see only what they should.

You'll learn:

• How to create and assign customer groups
• How to restrict request types by group
• How to control per-request visibility
• How to lock down agent-side access

Verified against Atlassian Cloud Jira Service Management on 2026-05-04.

Prerequisites

How ScaleIT handles this: See Jira Rescue

• Admin or project-admin role in your JSM project
• At least one customer organization already created
• 15 to 20 minutes

Customer Groups: Gate Request Types by Role

Customer groups segment which request types appear in the portal for different customers within an organization.

1. Open your JSM project. Go → Project settings → Customers.
2. Select an organization and click Create group.
3. Enter a group name (e.g., "Finance Team", "IT End Users").
4. Click Add customers and select members.
5. Click Save.

Now restrict request types to these groups:

1. Go → Project settings → Request types.
2. Select a request type and click Edit.
3. Under Availability, check Customer groups to specify which groups see it.
4. Click Save.

Request-Type Restrictions: The First Filter

Each request type has its own access gate, applied before customer-group mapping. A request type set to "Agents only" never appears on the portal.

1. Go → Project settings → Request types.
2. Select a request type and click Edit.
3. Under Who can raise this request?, choose Portal and email, Agents only, or Restricted.
4. Click Save.

Per-Request Sharing: Handle Exceptions

The Share this request with field handles one-off cases where a specific request needs visibility outside normal group structure.

1. Open a request in the portal or agent view.
2. Scroll to Share this request with.
3. Type a customer name or email and click to add.
4. Click Save.

The recipient must be a customer in your project. Add them via Project settings → Customers if needed.

To automate sharing: Go → Project settings → Automation, create a rule triggered on Issue created, and add action Edit issue → Share with customer.

Work-Item Security: Restrict Agent Access

Work-item security controls which agents can see a ticket—separate from customer restrictions. Use this for sensitive work items (HR, VIP incidents, compliance cases).

Set up security levels

1. Go → Project settings → Permissions → Issue security.
2. Click Manage issue security schemes or Create scheme.
3. Click Create a level and enter a name (e.g., "HR Only").
4. Add users or groups who can view work items at this level.
5. Click Save.

Apply security levels

Manual: Open a work item, scroll to Level, select the security level, and click Save.

Automated: Go → Project settings → Automation, create a rule triggered on Issue created, add condition Issue type = "HR Request", and add action Set security level = "HR Only".

How the Layers Interact

Request-type restrictions filter first (agents only = hidden). Customer groups filter next (only their group's request types appear). Shared requests show in "Shared with me". Work-item security restricts which agents see tickets, regardless of customer status.

Verify the Setup

• Customer groups: Log in as different groups. Verify only mapped request types appear.
• Request-type restrictions: Try creating a request for a type marked "Agents only"; the button should not appear.
• Shared requests: Open a shared request; it should appear in "Shared with me".
• Work-item security: Log in as an agent not in the "HR Only" group. HR requests should not appear in search or queue.

Troubleshooting

Customer sees request types they shouldn't.

• Check request-type restriction. If set to "Portal and email", customer-group mapping is ignored.
• Confirm the customer is in the correct group and the group is assigned to that request type.

Shared request doesn't appear in "Shared with me".

• The recipient must be a customer in the project. Add them via Project settings → Customers → Add customers.

Agent sees tickets they shouldn't.

• Open the work item and check its Level field. If empty, no security is applied.
• Confirm the agent is in the group assigned to that level.

Request type doesn't appear after assigning to customer group.

• Verify the request type is not also restricted to "Agents only".
• Both filters must allow access.

Ready to Tighten Access Control?

Clean segmentation keeps customers focused on their own work and prevents access drift. If you'd like help auditing your current setup or automating group membership, reach out for a free consultation.

Verified against Atlassian Cloud Jira Service Management on 2026-05-04. Vendor docs: https://support.atlassian.com/jira-service-management-cloud/docs/manage-your-customers-and-organizations/, https://support.atlassian.com/jira-service-management-cloud/docs/create-security-levels-for-issues, https://support.atlassian.com/jira/kb/understand-share-options-in-jira-service-management-cloud-portal/, https://support.atlassian.com/jira/kb/limit-project-visibility-to-customers-on-portal-in-jsm-cloud/, https://support.atlassian.com/jira/kb/how-to-manage-access-jira-service-management-projects-requests/.