locked
Field Level Security in MS CRM 2011 RRS feed

  • Question

  • Hi,

    It is possible to apply fiedl level security for users but how to apply field level security for roles in MS CRM 2011 ?

    Thanks,

    Srikanth Reddy

    Wednesday, August 1, 2012 1:54 PM

Answers

  • There is no such functionality in CRM, as I mentioned, FLS is designed to be assigned to users directly and be independent from security roles. Why don't you simply assign the FLS profile to the users/teams who should have access to the secured field?

    Otherwise you would need to build some really complex JavaScript which you retrieve the current user's security role and disable the attribute according to a mapping which you would also have to implement. Besides the igh amount of effort, it will also hurt performance as it will slow down opening forms in CRM. Additionally, it can only secure attributes in the forms but not from reports, advanced find, etc. I would recommend you use the feature provided which works based on users/teams and not security roles.


    Gonzalo | gonzaloruizcrm.blogspot.com

    Wednesday, August 1, 2012 4:49 PM
    Moderator

All replies

  • Hi Srukanth,

    Field Level Security is independent from security roles. If you want to grand FLS privileges it has to be done directly to either users or teams.


    Gonzalo | gonzaloruizcrm.blogspot.com

    Wednesday, August 1, 2012 2:16 PM
    Moderator
  • Thanks for your response! how to disable to field based upon security roles in MS CRM 2011.
    Wednesday, August 1, 2012 2:30 PM
  • Thanks for your response! how to disable to field based upon security roles in MS CRM 2011.

    What do you mean "how to disable to field based upon security roles"

    Gonzalo | gonzaloruizcrm.blogspot.com

    Wednesday, August 1, 2012 2:31 PM
    Moderator
  • I want to disable the attribute of the form depends on the security role of logged in user!!
    Wednesday, August 1, 2012 4:22 PM
  • There is no such functionality in CRM, as I mentioned, FLS is designed to be assigned to users directly and be independent from security roles. Why don't you simply assign the FLS profile to the users/teams who should have access to the secured field?

    Otherwise you would need to build some really complex JavaScript which you retrieve the current user's security role and disable the attribute according to a mapping which you would also have to implement. Besides the igh amount of effort, it will also hurt performance as it will slow down opening forms in CRM. Additionally, it can only secure attributes in the forms but not from reports, advanced find, etc. I would recommend you use the feature provided which works based on users/teams and not security roles.


    Gonzalo | gonzaloruizcrm.blogspot.com

    Wednesday, August 1, 2012 4:49 PM
    Moderator
  • Thanks Gonzalo Ruiz R! I agree if I develope the custom java script it will impact on the performance, but In my requirement Particular role is having 50 memembers, if I want to use in-built FLS I should add all 50 users, we can't add team in FLS. so I think there is no way other than developing the custom java script code. Please suggest!! 
    Wednesday, August 1, 2012 5:08 PM
  • Why you cannot add team to FLS? You can create a team and add all the 50 members to that team. Then you can grant the team the FLS profile you need. I don't understand what is your problem.

    Gonzalo | gonzaloruizcrm.blogspot.com

    Wednesday, August 1, 2012 5:24 PM
    Moderator
  • Thanks Ruiz! yes we can add teams to the FLS profiles, with in the team we can add role by this way we can work it out without developing the custom java script code right ? 

    Wednesday, August 1, 2012 5:47 PM
  • right, you would not need any JavaScript if you use the team approach or if you assign the FLs profile to the users

    Gonzalo | gonzaloruizcrm.blogspot.com

    Wednesday, August 1, 2012 5:50 PM
    Moderator
  • Hi Srikanth,

    If you want to disable a field based on a security role, you could also create 2 forms, that will be displayed to users based on their security roles. One of the forms will have the field active, and the other would be inactive.

    When you have this type of requirement that depends on security roles, then forms are the out-of-the-box solution to deal with that.

    Best regards,

    Paulo


    Thursday, August 2, 2012 9:22 PM
  • Is the problem solved? If not I have the java script ready with me to disable a feild depending on the user role.
    Friday, August 3, 2012 9:04 AM
  • Hi Srikanth,

    If you want to disable a field based on a security role, you could also create 2 forms, that will be displayed to users based on their security roles. One of the forms will have the field active, and the other would be inactive.

    When you have this type of requirement that depends on security roles, then forms are the out-of-the-box solution to deal with that.

    Best regards,

    Paulo


    Keep in mind that if you use a 2nd form and don't use Field Level Security, users will still be able to see the fields in Advanced Find and in reports.  This may be fine for certain requirements and not for others.

    Jeff


    Tuesday, November 6, 2012 12:10 PM
  • Hi,

    link to refer:http://blogs.infinite-x.net/2010/11/16/retreiving-user-roles-in-crm-2011/

    by using above link, we can check security role as

    If (UserHasRole("System Administrator")) { // do something important }

    else if(UserHasRole("Sales Person"))

    {

    //her we can hide/disable fields

    }


    (Mark as answer and vote as helpful)

    Greetings,

    SASANK K

    Tuesday, November 6, 2012 12:22 PM
  • Sasank,

    This is perfectly acceptable for some requirements,  but keep in mind that JavaScript should not be used to enforce security;  the user can still access hidden fields using Advanced Find or by digging through the form's HTML.

    See the "Factors to Consider.." section here.

    Regards,
    Jeff

    Tuesday, November 6, 2012 12:41 PM
  • Hi Jeff Klosinski,

    Yes, you r correct.....

    This is only works on form state.

    if it is not useful better use field security level.

    (Mark as answer and vote as helpful)

    Thanks,

    SASANK K

    Tuesday, November 6, 2012 12:53 PM