Configure Access Teams in Dynamics CRM 2013

In Dynamics CRM 2013 there is a cool new feature that allows us to assign records to multiple users through the use of Access Teams. An Access Team is basically a sub-grid of users that have access to a particular record. This means on an Opportunity for example, where multiple sales people may be involved we can add additional users into the access team to allow them access to the record.

First I’ll walk through how to set up access teams, then I’ll explain a bit more about it.

1. Enable the entity for auto-created access teams

To get started you need enable the entity for auto-created access teams. To do this, open the customization area and navigate to your entity. In my example I will use Account. Under the ‘Options for entity’ there is a new option called ‘Access Teams’. Toggle this on, and then save and publish the entity.

Note: Once this is enabled it cannot be disabled after saving.

2. Create Access Team Template

Next you need to set up the team templates, which define what levels of access the users will have to the record. Access Team Templates and created and managed from Settings -> Administration -> Access Team Templates. By default there is already a template for Opportunity, as opportunity has access teams enabled already for use with the ‘Sales Team’.

When you create a new Team Template, you can specify the Entity to use, which will only display entities that are enabled for ‘Access Teams’. We then select the Access Rights we want to grant our users. Remember that all security is additive, so if the users are given Organization Write access in their security roles, but we don’t give them Write access here, they will still have write access on the records.

We can also define multiple Access Team Templates for a single entity, however at the time of writing this blog post, using more than one template on the same entity still has some bugs. Supposedly this will allow us to configure multiple sub-grids on our form to define different levels of access for different groups of users.

3. Add Users sub-grid to entity form

The last step is to add a sub-grid to the form so you can associate users into the access team. This step has a bit of a trick to it, which wasn’t obvious at first. When configuring the sub-grid; you need to select ‘All Record Types’ instead of related only. You can then select the ‘Users’ entity. Finally the tricky part is that you need to select the ‘Associated Record Team Members’ view, which will then display a ‘Team Template’ field which allows you to select the team template to use for this sub-grid.

Note: changing an existing sub-grid will not work, so you’ll need to add a new sub-grid.

Once you’ve added your sub-grid you can save and publish the form and then try it out. You can see below I’ve added the ‘Owners’ sub-grid to the account form, and associated a couple of users using the ‘+’.

Note: The actual ‘Owner’ of the record will not change when using Access Teams.

So how does it actually work? Where are these users stored? How are they given access?

If we do an advanced find on ‘Teams’ we can see there’s a new filter added, which excludes teams of type ‘Access’ by default. If we simply remove this filter, we can now see a team with a GUID name. Upon opening this team, we can see the users we associated are added as members. On closer inspection, the Team Name (the GUID) is actually the ID of our account record. From here we can also modify the team members, which will directly update the sub-grid on our account form.

As for ‘how’ the team gains access to the record, it doesn’t seem to be ‘shared’, so this is still unclear.

Important things to note

- If you delete the physical team record, the account in my case will be reset as if there were no users associated in the sub-grid. As soon as you add a user back into the sub-grid, a new team record will be created. Note that the physical team is not deleted if you only remove the users from the sub-grid.

- Modifying the Team Template access rights will not affect existing teams. Only new records/access teams will inherit the updated permissions.

- Records will not display in ‘My’ views, as these views are filtered by ‘Owner = Current User’ so users granted access via Access Teams will have to view ‘All’ records to see them.

- To delete a Team Template, any sub-grids that reference the team template must first be removed.

 Overall I think this feature will be really useful when configuring security models, as it gives us another depth of team access which wasn’t quite there in CRM 2011 using just teams.