External Participants

An external participant is a named person outside your organization who is invited into one specific ticket. They get a sign-in of their own, separate from any staff account.

They see only the tickets you link them to — nothing else. No queue, no search, no other tickets, no projects, no internal comments, no internal files. If you invite the same person to a second ticket, that is a second link, made separately. Their access is nothing more than the tickets you have explicitly linked them to.

This is not the same as a Customer Portal single sign-on (SSO) requester. A requester signs in through the Customer Area, can raise their own tickets from the catalog, and never gets an external-participant password. An external participant is invited to a ticket that already exists and cannot raise anything.

Before you start

• External participant access has to be switched on for your organization. If the controls are missing, it is not.
• You need Work or stronger access to the ticket.
• Check the email address and the ticket. An invitation sent to the wrong address cannot be recalled.
• Keep invitation links and passwords out of notes, tickets, and evidence.

Invite someone

1. Open the ticket and find the external participant controls.
2. Select Add external participant and enter the person. If they were previously a participant on this ticket, this brings that link back.
3. Select Issue invitation. If the control reads Reissue invitation instead, an invitation is still live — not yet used and not yet run out — and selecting it replaces that one. Once an invitation has run out or been used, the control goes back to Issue invitation.
4. To see what will be sent, expand Review delivery package. Do not copy its contents anywhere — it shows the live enrollment link itself.
5. Select Send invitation email once. Open email draft is the alternative if your organization would rather send the message itself.
6. Confirm the ticket shows the person as invited.

The state shown against each person

The entry carries a state, and it tells you exactly how far along they are:

An entry sitting at Contact only is doing nothing but recording who the contact is. That is the state you get if you add someone and stop.

What the invitation does and does not carry

Review delivery package lists this explicitly, and it is worth reading once so you can answer the question confidently when someone asks.

The message itself repeats the promise at the foot: "This message does not include ticket conversation, attachments, or internal working detail." The invitation carries the ticket reference but not its title.

The name you type may not be the name they keep. If the person already has an established external identity, that identity's own name is what appears afterwards — not the name you entered when adding them to this ticket.

The invitation is valid for 24 hours and can be used once. After that it stops working and you have to reissue it.

Sending an invitation is not proof it arrived. Email can be delayed or blocked, and the person has no access at all until they finish the steps below.

What the invited person does

They do this themselves, from the link in the email.

1. Open the link within 24 hours.
2. Read Current invitation details — their name, a partly hidden version of their email, the organization, and when the invitation runs out. The ticket is deliberately not shown at this stage.
3. Under Establish your bounded access identity, set a password of at least 12 characters. Someone who has been an external participant before is asked for their existing external password instead.
4. Select Complete enrollment once.
5. They arrive at External Access and see the tickets they are linked to.

If the invitation has run out, has already been used, or has been tampered with, the page says only that it is unavailable. It does not say which of those it was.

If the person's access has been switched off, the page still opens and still shows their name, their partly hidden email, and the expiry. It refuses only after they set a password and submit. Someone in that state will tell you they got most of the way through and then it stopped.

To sign in later, they open the external sign-in page, enter their Invitation email and External access password, and select Sign in to External Access. Your linked tickets lists what they can open.

What they can do in the ticket

They open the ticket from Your linked tickets and see Current linked request and Shared request context — the parts of the ticket shared with the external side. Under Bounded external follow-up they see Shared conversation and Files shared for this ticket, and can sort comments with Newest first or Oldest first.

Two things they can do:

• Post a public reply. They open Add a public reply, type it, and select Post reply once. It appears in Shared conversation. Here, public means visible in this ticket's shared conversation — it is not visible on the internet. It does not become an internal comment, and you will also see it in the internal ticket view.
• Upload a file. They use Choose a file for the shared exchange, keep it to 10 MB or less, and select Upload file once. They can download files offered in the shared list.

The ticket's active files must also total 50 MB or less after their upload. That 50 MB is the whole ticket, staff files included. Files your colleagues uploaded can therefore use up the room and block an external participant from uploading anything, without them being able to see why.

If the ticket is no longer linked to them, they get Ticket not available or a not-found result that says nothing about whether the ticket exists.

What you should not put in front of them

Anything in the shared conversation or the shared files list is visible to the external participant. Before you post or attach:

• Keep internal comments, internal diagnostics, staff lists, and internal attachments out of it.
• Confirm each file is approved for sharing outside the organization.

External-safe is the product's label for content shared into this lane. It is a visibility setting, not a check on the content — nothing has been scanned, reviewed, or certified.

Ending access

There are two separate things you can end, and they do different jobs.

Disabling and re-enabling a sign-in does not change which tickets they are linked to. Re-enabling someone does not restore a ticket link you removed — link them again if that is what you want.

Removing a ticket link

This is the first row of the table above — Remove on the ticket. It ends one link. It does not end the person's external sign-in, which is a separate, admin-gated action in External Identity Administration.

It takes effect immediately, including on someone already signed in. There is no confirmation step: selecting Remove ends the link at once. If the person has that ticket open, their next action on it is refused. They are not signed out, and the rest of their external workspace keeps working — only that ticket stops being reachable.

What they see is:

Ticket not available.

That wording is deliberate. It does not say their access was withdrawn, and it is the same message they would get for a ticket that never existed or was never shared with them. Removing someone does not tell them they have been removed. If they need to know, tell them yourself.

Disabling the sign-in

This is the second row of the table above — a System Administrator disables the identity in External Identity Administration. It is broader than removing one link: it ends the person's access to the whole external workspace, not one ticket. Only an administrator can do it, it needs identity re-verification, and — where your organization requires regulated approval for external identity changes — it goes through that approval as well, so it takes several deliberate confirmations, not a single click.

Like link removal, it takes effect on their next action, not the moment they sign out. Someone already signed in is not forced out — the page they are on stays on screen. But their next action is refused, because the account is now inactive. Do not assume a disabled person keeps working until they sign out; treat them as locked out at once.

What they see differs from link removal by scope:

External access not available.

The specific ticket they had open still reads Ticket not available, but the external home now reads External access not available — the entire workspace is refused, not just one ticket. As with removal, the wording does not tell them their access was withdrawn.

Re-enabling the identity is the same admin-gated, step-up action in reverse and restores access on their next request. It does not restore any ticket links that were separately removed.

If it does not work

• You sent it to the wrong address. Stop. Do not send a second invitation to the right address as a fix. Remove the participant, then invite the correct person.
• They say the link does not work. Check whether more than 24 hours have passed or whether they already used it, then issue a new invitation. Once the old one has run out, the control reads Issue invitation again. Do not send the same link again.
• They cannot upload a file. Check the ticket's total active files against the 50 MB ceiling. It is shared with staff attachments, so files your colleagues added can be what is blocking them. Remove or reduce files on the ticket, then ask them to try again.
• They say they cannot sign in. Check with your System Administrator whether their access has been switched off, either individually or for the whole organization. Do not create a second identity for them.
• The external controls are not on the ticket. External participant access is not switched on for your organization. Ask your System Administrator.
• They cannot see a reply you posted. You posted it as an internal comment. Only public replies reach the shared conversation.

Related pages

• Work a Ticket
• Ownership and Participants
• Workflow Actions
• Approvals