CRM Security Model Internals

Microsoft CRM Security Internals

K. Brian Kelley - Databases, Infrastructure, and Security — Tue, 10 Apr 2007 01:21:53 GMT

On the Microsoft Dynamics CRM Team Blog, Jay Grewal has posted information about the CRM Security Model...

re: CRM Security Model Internals

Paul Turner — Mon, 04 Jun 2007 05:12:56 GMT

Great article on the internals.

re: CRM Security Model Internals

Bilal Yasseen — Wed, 02 Jul 2008 16:34:50 GMT

Hi Jay,

What's the best way to generate an Access Matrix Report for MS CRM 4.0?

For each entity (custom or system), the report should display:

- the Access Rights (Create, Read...) as rows

- the Security Roles as columns

- the data as the privilage depth (user, business unit...) if the role has access otherwise display "No Access"

Kindly note that this is really urgent.

Your Help is really appreciated.

re: CRM Security Model Internals

Kumar — Fri, 04 Jul 2008 19:13:58 GMT

Good article. We have a situation related to security(in CRM 4.0) where we all users have access to Read + Edit all Accounts but if a certain account is marked as "Secret", only a defined list of users should be able to Read + Edit it and all other users will not even have read permissions to that record.This list of users is per account level and is dynamic. You can add/remove people from this list. How can this be implemented using CRM security model?

re: CRM Security Model Internals

Frank Lee — Fri, 04 Jul 2008 23:11:28 GMT

If needing a more dynamic "Secret" list of users - either setup a busness unit/security role setup that supports it OR use Record Sharing to achieve it.

Frank Lee, Microsoft Dynamics CRM MVP

http://microsoft-crm.spaces.live.com

http://www.workopia.com/Links.htm

re: CRM Security Model Internals

Niamh — Tue, 15 Jul 2008 12:02:00 GMT

Hi Jay,

I have a similar situation. I am working with a sales organisation. They want users in different divisions not to be able to see each other's contacts, opportunities, quotes etc. I have acheived this using business unit and role setup. However they want to make a list of certain contacts available to the whole organisation, but want to keep the inofrmation below the contact such as opportunity, quote private to just the individual divisions. If they use sharing to make records available to all, then users can automatically see all information related to that contact (opportunities/quotes). I cannot see any way to acheive this using business units and roles as they only want to share certain contacts. Any advice would be appreciated.

re: CRM Security Model Internals

Shilpa — Mon, 17 Nov 2008 08:22:43 GMT

Hi,

Couls you please let me know an efficient way of checking whether user has a sharing to particular record theu "Principal object access". We have over 1 crore records in POA table. Dependind on this we need sahre the record to user thru security principal class..... Currently so hare around 10 opp(along with sharing accounts, conatc and few other custom entities are taking long time).

Pls suggest on the same.

Thanks in advance.....

re: CRM Security Model Internals

reicoskyr — Tue, 13 Jan 2009 19:57:18 GMT

Has anyone seen the message: Users cannot add privileges to or change access levels for roles to which they are assigned. For Help with Changing a role, contact your CRM administrator.

The problem is, I am the System Administrator, and still get this message, and I do not belong to the role that I am trying to change. Any ideas

re: CRM Security Model Internals

Anne Stanton — Wed, 08 Jul 2009 03:36:10 GMT

Jay -

Thanks for writing this up. It is still helpful two years later ;)

Anne

re: CRM Security Model Internals

Austin — Thu, 03 Sep 2009 22:42:25 GMT

I don't understand why it isn't possible to assign a user to a Security Role within other business units. Sharing has to be set on the account or contact, which means each time a new account or contact is setup someone has to remember to share it. If the user could just take on a role from another Business Unit, then they would have the proper access to existing and new accounts without further work.Microsoft has really limited CRM by implementing their security this way. How SAD. Now i have to jump through hoops to make a unmanageable workaround.