locked
Exporting in SQL reports without export rights in CRM... Help! RRS feed

  • Question

  • Hi everybody!

    I hope this hasn't been asked before - I did a search on the forum and couldn't see anything, so perhaps it's only us having this issue.

    We've recently upgraded from 3.0 to 4.0 (loving it so far!). We have a number of SQL reports running in CRM, from which our sales team needs to export data on a regular basis. Normally they export from the reports to either PDF or excel.

    The problem we're having is that our company has made the decision not to allow users export rights from CRM - it's a security thing. Unfortunately, we've discovered that in v4.0 we have to give users full export rights in CRM for them to be able to export data in the SQL reports.

    We didn't have this problem with v3.0 - I guess report rights were kept separate from CRM rights.

    Does anybody have a suggestion as to how we can get around this? As in, give our users rights to export from SQL reports in CRM, but not from CRM itself.

    I thought maybe we could hide the 'Export to Excel' button in CRM wherever it appears, but I haven't been able to find anything online about how to do this. I suppose the other solution is to move the reports off CRM and just onto Reporting Services, but then we don't have the advantage of the Advanced Find filtering within CRM. So that's not ideal.

    Any thoughts/suggestions would be greatly appreciated!!

    Thanks in advance,
    Kat

    :)
    Friday, March 27, 2009 4:50 PM

Answers

  • I understand why they've done it. In version 4 users can make their own reports through the CRM report wizard which means if they can export out of reports, they can easily circumvent the export security in the product.

    You probably can code your way around this but my advice would be to educate the decision makers on the reasons why the product is acting the way it is and encourage them not to restrict export if they want users to extract data from reports as it is essentially equivalent to exporting directly out of the product.

    Leon Tribe
    Want to hear me talk about all things CRM? Check out my blog
    Saturday, March 28, 2009 12:14 AM

All replies

  • I understand why they've done it. In version 4 users can make their own reports through the CRM report wizard which means if they can export out of reports, they can easily circumvent the export security in the product.

    You probably can code your way around this but my advice would be to educate the decision makers on the reasons why the product is acting the way it is and encourage them not to restrict export if they want users to extract data from reports as it is essentially equivalent to exporting directly out of the product.

    Leon Tribe
    Want to hear me talk about all things CRM? Check out my blog
    Saturday, March 28, 2009 12:14 AM
  • Hi,

    Another issue is that both the reports and the excel export uses the filetered views, which the user have read access to.

    A filtered view has built in the security modell, so that reports and excel queries return same result as when you serach in CRM. CRM is not using the filetered views, because CRM evaulate the security modell in the business layer.

    So, let us say that you are able to hide the Excel button, and program your way around the export capabilities in the reports; you will still have a backdoor in that users can connect directly to these views from for instance Excel. Because you will need to use he filtered views.

    One possible solution could be to create a log that register users when starting a report or an Excel export from CRM. And you could have added logic to the filetered views that checked if such a log had been created during last 30 seconds for a specific user, as an addition to the security checking that already is in the filetered views. etc ... far away from "within standard config". With this approach there would still be a chance that a user runs a "legal" report, at the same time fires a home made query from Excel.

    As you see this becomes a complex issue, so the human approach proposed by Leon is probably the best solution.

    Employees should also have in their contract something about company property etc.

    Wow, this was lots of typing without giving you any answer ... but hopefully some perpective on why this will become difficult.

    Supporting Leon's view.

    Morten
    Saturday, March 28, 2009 7:05 AM
  • Thanks folks. Not quite the response I was hoping for but I can see where you're coming from.

    Unfortunately my technical expertise isn't great enough to even attempt the coding required to hide the Excel button... and certainly not to create a log file :)

    As for the users, they are unaware of the custom report functionality for much the same reason (i.e. what they don't know can't hurt us!). Also, we don't use any of the standard CRM reports, so the data that can be accessed through our CRM reports is fairly limited in any case (some limited opportunity/activity data). But Export functionality means that data that would not be available through our reports is suddenly available through other means (lists of clients & prospects, effectively).

    It's my understanding that we DO have a clause in our contracts about data - but that hasn't stopped unscrupulous people in the past! Hence the measures put into place in the v3.0 system.

    Anyway, many thanks! Going away now to bang head against desk ;)
    Tuesday, March 31, 2009 9:12 AM
  • Hello Kat,

    I have the exact same problem. The rights to export to Excel and PDF should be differentiated.
    For example, I want to allow my salespeople to save (export) invoices as pdf files, but forbid them to export accounts and contacts to excel. This is not possible in the current version, so I went for this workaround:

    installed PDFCreator on sales people's workstations so they can print the invoice report as a PDF.

    Regards,
    Alex.

    Thursday, November 26, 2009 11:27 AM