Jira Service Management · Portal Governance for JSM

Audit who can access every JSM portal

Every customer, organization, and agent grant on every portal, with drift, deactivated-account flags, and opt-in cleanup.

Try it free on the Atlassian Marketplace Documentation

Runs entirely on Atlassian Forge inside your own tenant. No external servers, no data egress.

The gap

Customers get added desk by desk, organizations drift, agents inherit access through groups nobody re-checks, and deactivated accounts linger on the Service Desk Team role. JSM has no single view of who can reach which portal.

What it does

Scans every service desk daily and on demand.
Lists every customer with direct portal access, per desk.
Rolls up every organization grant with its membership size and members.
Classifies every Service Desk Team agent grant: direct vs group.
Flags deactivated agents, group-granted access, empty orgs, and empty portals.
Diffs each scan against the previous snapshot for per-desk drift, and exports the matrix as CSV.

The per-desk access matrix: customers, organizations, and agents in one view.

Exposure flags surface deactivated agents and group-granted access.

The daily scan diffs each desk against its previous snapshot.

60-second walkthrough

Honest about its limits

Organization membership reads require the customer-management scope; the app uses it for GET calls and the opt-in cleanup only.
Drift history starts at install; the app cannot reconstruct grants that changed before its first scan.
The one write path, honestly scoped: An opt-in, admin-gated cleanup can remove flagged customer grants, always from a preview you approve first.

Security & permissions

Built on Atlassian Forge: the app runs on Atlassian's own serverless platform inside your tenant, stores its data in Forge storage, and makes no external network calls. Every scope it requests, and why:

read:servicedesk-request	desks and portal configuration
manage:servicedesk-customer	organization membership GETs and the opt-in cleanup DELETEs
read:jira-work / read:jira-user	agent and account details
storage:app	report cache and scan state, in your tenant

FAQ

Does any data leave my instance?

No. The app runs on Atlassian Forge inside your own tenant with zero external egress, which makes it eligible for Atlassian's "Runs on Atlassian" trust marker.

How is it billed?

Through the Atlassian Marketplace, on your existing Atlassian bill, priced per user like any Cloud app. The listing has a free evaluation and the exact calculator for your tier.

Where do I get support?

Email support@llmgraph.ai or open an issue from the documentation page. You talk directly to the people who build the app.

Install Portal Governance for JSM in about a minute.

Free evaluation from the Marketplace listing. If it does not fit your workflow, tell us what would and we will build it.

Try it free Read the deep-dive