Answered by:
Security Roles and Permissions question

Question
-
Hi All,
I am new to Dynamics and trying to understand the security model, and have a couple of questions regarding that
a) What does it mean for a Role to have a Create permission for an entity for the 'Organization' vs the 'User'. Read/Write/Delete/Append etc make sense to me for User vs Org but not create.
b) I am quoting from Dynamics CRM Unleashed book "If a specific Security Role is required on a Child Business Unit, you must create a new Security Role, navigate to the Child Business Unit, and select Copy Role from the More Actions drop-down menu. After you copy the Security Role, you cannot modify it. The Security Role also will apply only to the Business Unit and any children where it was copied." So it seems like all roles are created at the Root org, and if I want to apply them to a user in a child BU, i have to copy that role to the child BU? Wouldn't the roles just from from the root to the children? If they do flow from the Root to the Children, why do i want to associate them with a Child BUs? Is this more for organizational reasons. The following text from the same book adds to my confusion "With Microsoft Dynamics CRM 4.0, Security Roles are flexible and easily created, and extend security to custom entities. By default, new Security Roles are created on the Organizational level and inherited by Child Business Units, regardless of which Business Unit is selected from the Security Roles Administration screen ".
Also if there is a good book/website to read about roles please let me know.
Thanks much,
-Vivek
Friday, April 2, 2010 7:38 PM
Answers
-
a) Not a lot of difference in practice. I've sene it written that it allows you to assign different ownership to the record at creation but that's about it.
b) I'm a little confused by the first quote. You create a role and give it a BU. That role flows down to all child BUs. From memory the child BU clones are read-only.
Leon Tribe
Want to hear me talk about all things CRM? Check out my blog
http://leontribe.blogspot.com/
or hear me tweet @leontribe
Want to hear me talk about all things CRM? Check out my blog http://leontribe.blogspot.com/ or hear me tweet @leontribe- Proposed as answer by Leon TribeMVP Saturday, April 3, 2010 9:47 AM
- Marked as answer by Jim Glass Jr Monday, April 5, 2010 2:11 PM
Saturday, April 3, 2010 9:46 AM
All replies
-
Hi Vivek,
A. Entities have two types of ownerhsip: User and Organization. If an entity has organization ownership, then you only have one security option -- all or nothing. If an entity has user ownership, then you can granually define the permissions read/write/delete/...
B. Security roles do flow from root business unit to child business unit and you CAN use them at the child business unit if they are defined at the top. The CRM Unleashed book means that if a unique or specific security role is required at a business unit then you should copy an existing role and modify it there.
Alex Fagundes - www.PowerObjects.comFriday, April 2, 2010 7:56 PM -
Hi Vivek,
A. Entities have two types of ownerhsip: User and Organization. If an entity has organization ownership, then you only have one security option -- all or nothing. If an entity has user ownership, then you can granually define the permissions read/write/delete/...
B. Security roles do flow from root business unit to child business unit and you CAN use them at the child business unit if they are defined at the top. The CRM Unleashed book means that if a unique or specific security role is required at a business unit then you should copy an existing role and modify it there.
Alex Fagundes - www.PowerObjects.com- Proposed as answer by Alex Fagundes - PowerObjects Friday, April 2, 2010 7:57 PM
Friday, April 2, 2010 7:56 PM -
Thanks Alex,
I didn't think about the role ownership plays here. So as an example:
a) If i have a custom entity called Skills with Organization ownership and its either the users get full permissions (Create, Read, Update, Delete) on it or nothing.I can't just make it a read-only organizational entity
b) If i have an entity like Account with user ownership, i can refine the visibility to be user/bu/parent-child/org. This makes sense for Read, Delete, Update, however what does it mean to have these permissions for create? A user with Business Unit permissions on create for Account vs a user with User permissions on Account?
Now regarding security roles: So by default all roles are created at the top, and if i need to tweak a role for a Business Unit i can copy it to the Business unit and modify it. So what's the purpose of selecting a Business Unit when I create a role?
-Vivek
Friday, April 2, 2010 8:20 PM -
a) Not a lot of difference in practice. I've sene it written that it allows you to assign different ownership to the record at creation but that's about it.
b) I'm a little confused by the first quote. You create a role and give it a BU. That role flows down to all child BUs. From memory the child BU clones are read-only.
Leon Tribe
Want to hear me talk about all things CRM? Check out my blog
http://leontribe.blogspot.com/
or hear me tweet @leontribe
Want to hear me talk about all things CRM? Check out my blog http://leontribe.blogspot.com/ or hear me tweet @leontribe- Proposed as answer by Leon TribeMVP Saturday, April 3, 2010 9:47 AM
- Marked as answer by Jim Glass Jr Monday, April 5, 2010 2:11 PM
Saturday, April 3, 2010 9:46 AM