Gustaf Westerlund | Adam Vero SECURITY BEST PRACTICES PART 1: OPTIONS AND COMMON USES IN DYNAMICS CRM

#CRMUGCongress16 Founder, CTO, MVP, MCT, IT-guy etc. CRM-Konsulterna Working with CRM since CRM 1.2 Projects from 1 user to 5000 gustafwesterlund.blogspot.com GUSTAF WESTERLUND

#CRMUGCongress16 Freelance Consultant, MVP and Microsoft Certified Trainer Co-Founder of CRMMasters Working with CRM >7 blog.CRMguru.co.uk ADAM VERO

#CRMUGCongress16 45 minutes Config and Customization eLearning SCOPE

#CRMUGCongress16 Business Unit Users Teams Security Roles Privilege CONCEPTS

#CRMUGCongress16 Root/child business units Enable/disable Moving/reparenting Renaming Note – Beware of overloading – use for security BUSINESS UNITS

#CRMUGCongress16 USERS/TEAMS Belongs to BU Can have Security Role Can own records Rights will propagate to users Can be deleted There are default BU teams Team Belongs to BU Should have Security Role Can own records Manager Can be in teams Cannot be deleted User

#CRMUGCongress16 USERS ONPREM VS ONLINE Auth by O365 or connected Federated ADFS User created by giving license in O365 Admin portal Online Auth by AD or ADFS AD: User exist in AD, CRM lookup ADFS: CRM adding ” account” user Onprem

#CRMUGCongress16 Security Role is connected to BU Security Roles have identical RO copies in child BU Moving user to other BU -> removes all security roles Reparenting BU -> All users will loose roles NOTE!

#CRMUGCongress16 PURPOSE OF THE SECURITY MODEL

#CRMUGCongress16 Modify existing (not recommended) Create new Make Copy Each user can have one or many security roles Rights for a user always additative SECURITY ROLES

#CRMUGCongress16 None = No rights User = The records I own Business Unit = Records owned by people in my BU Parent Chiled BU = Like above but with all BU below Organization = Rights to everything ACCESS LEVELS

#CRMUGCongress16 Privileges set per entity ENTITY BASED PRIVILEGES

#CRMUGCongress16 Root Business Unit SalesMarketingService Support Projects

#CRMUGCongress16 Privileges for specific tasks Mostly just on or off TASK BASED PRIVILEGES

#CRMUGCongress16 LAYER VS SINGLE ROLE

#CRMUGCongress16 SECURITY ROLES: MULTIPLE ROLES Security Role: Baseline for all users Account Opportunity Case ReadWriteAssign Security Role: Sales Person Account Opportunity Case

#CRMUGCongress16 SECURITY ROLES: EFFECT OF MULTIPLE ROLES Security Role: Baseline for all users Account Opportunity Case Effective Permissions: Sales Person Account Opportunity Case ReadWriteAssign User gets all the privileges of all their roles

#CRMUGCongress16