In part one and part two of this series we looked at using Sharing and Teams in CRM to help handle the records that have security exceptions in CRM. In our final part, we will explore the use of Access Teams, a new feature in CRM 2013.
One difficulty with using teams or sharing the records with users or teams is that there is no easy or direct way to see the individuals who have access. You would need to look at Sharing on the record to see those given access. You would also need to view the Team record to see its members, and the person sharing the record would need to decide what permissions to assign the user or team.
This is where Access Teams will help you easily give users access to the record and see who had been provided access on the form. An administrator would also predetermine the security permissions, so there is less configuration for the user adding individuals to the Access Team for a record.
Setting up Access Teams in Microsoft Dynamics CRM is a process that needs to be completed by someone that can customize entities and forms in CRM. Some of the steps listed presume that the user configuring Access Teams is familiar with these practices and therefore this article will not go in depth in the customization basics.
To use access teams, we will need to complete the following:
Enable the entity or record type to allow the use of Access Teams.
Create an Access Team Template for that entity.
Add a sub-grid to the form of the entity and configure it for use with Access Teams
Add users to the Access Team
First you need to enable the entity or record type for use with Access Teams. This is done within the Entity Definition. The following diagram displays the setting:
There are some limitations to using Access Teams. For CRM Online and On-Premise, the default number of entities that you can enable for auto-created access teams is five. For On-Premise environments, this can be increased via PowerShell.
The next process to complete is to create an Access Team Template. This is used to define the permissions members of the Access Team will have to the record where they are added. With CRM Online and On-Premise there is a limit of two Access Team templates per entity. This also can be increased via PowerShell for On-Premise deployments. Therefore, you could create one template for read access and another template for write access to the record. The following diagram is an example of an Access Team Template:
After creating the templates you will need to add a sub-grid to the form of the entity. This is where you will add the members to the Access Team. The diagram below is an example of how to configure the sub-grid:
Once you have saved and published the changes, you can now open a record for the entity and add users to the Access Team. Adding a user to an Access Team is essentially the same as sharing the record with them. Therefore, the person adding members to this team must have the Share privilege for this record. Here are some other advantages to using Access Teams:
The user who adds a new member to the Access Team needs to have the same privileges as the rights you designated in the template. The user cannot grant more privileges than he/she currently has.
The users that are added to the team must also have at least User level access to the same privileges that the Access Team template has.
For example, a template may grant a user assign privileges in addition to other privileges. User A needs to have assign privileges to the entity. Therefore, User A cannot add User B to the Access Team in hopes User B will then assign the record to User A. If User A does not have assign privileges, they will not be able to add users to the Access Team using that template.
These rules prevent a user from adding himself/herself to an Access Team to give them more permissions to a record than he/she already has. The following diagram shows the Access Team sub-grid on the Account form.
Access Teams is a great way to quickly give users access to records that fall outside of the normal scope of records accessible based on his/her security role. While there is a little more configuration involved, it is a secure option that provides your administrators piece of mind when configuring security. Our CRM experts can help you will planning and implementing your Security in CRM. Contact us today.