Skip to main content

Notifications

Announcements

No record found.

Microsoft Dynamics CRM (Archived)

Difference between Access Team and Security Role

Posted on by Microsoft Employee

Hi guys,

I am reading about Access Team in CRM. I am wondering why would we need Access Team, could someone please give me a brief explanation with real example?

This is what I think:

- Access Team has the same privileges as what we have in Security Role for each kind of entity.

- We could create a Team, then assign security role to that team to achieve the same role, couldn't we?

- We even have the button share entity if it comes to sharing the entity.

Thanks guys!

*This post is locked for comments

  • Community Member Profile Picture
    Community Member Microsoft Employee on at
    RE: Difference between Access Team and Security Role

    Excellent and very easy to understand example Kokulan! Thank you so much

  • Verified answer
    gdas Profile Picture
    gdas 50,085 on at
    RE: Difference between Access Team and Security Role

    Hi,

    The purpose of using Access Team is to have 1.  large no of record sharing instead of traditional  record sharing due to performance and reduce POA table overhead ,2. Simplify administrative works and 3.Teams can define on runtime to share a record without own the record.

    Security role grant access to the entity  via predefined set of privileges.

    We could create a Team, then assign security role to that team to achieve the same role, couldn't we?

    As I mentioned that security role is predefined and having administrative task required but using Access teams user who does not have access to the record you could share the record to those user. So the main purpose of access team is to share record not ownership.

    We even have the button share entity if it comes to sharing the entity.

    Using  traditional sharing whenever you share a record to the user each time a record created in POA table. But for access team  one record will be create for a record. So using Access Team POA table  size will be less than traditional  share.

  • Verified answer
    Kokulan Profile Picture
    Kokulan 18,048 on at
    RE: Difference between Access Team and Security Role

    Hi

    If you google for Access Teams vs Owner Team, you will get quite a few useful links but I thought it might be easy to understand the difference by looking at a real-world example

    Consider the following scenario:

    I (let's call it Employee A) am working on a Case record (CASE A), and I want one of my colleague (let's call Employee B) from the Finance department to fill and verify some fields or section on the case record. Since I am the owner (in administrative terms - Ownership - Responsible-For) of the record, in typical security configuration, Employee B may have read access but won't be able to update the record unless they have security role grants them write access.  I only want the Employee B to have write access not everyone from the Finance department.  And let's say I want someone ( call it Employee C) from the HR department to verify some details on the case form and approve.

    Now, in this scenario, we have a temporary group/team (Employee A, B, and C) who are working on a case record. This team is not permanent and this team is a cross-department team and in some cases, it could even be a cross-business team. It's difficult to create a team (typical CRM Owner team), temporary sec role and add/remove members to it. It creates a lot of administrative overheads. And traditional team/sec role permissions only apply at entity level not at a record level so we cannot use owner team and security roles to solve this problem

    To solve this issue, Microsoft first introduced the Share record feature in CRM.  In the above scenario, I would have to share the record with Employee B and C by clicking Share and selecting the user and also selecting the permissions I want to give, please see below

    ScreenClip-_5B00_504_5D00_.png

    The share feature solved the problem and it has been one of the most used features in CRM since it was introduced.  But as users used the Share feature more and more, they faced the following primary limitations

    01. Primary Limitation OneNo visibility as to who works on the record - unless you go into Share modal and see the list there. So reporting and visibility of who has access to what is very limited -

    Potential Solutionwe should be able to have a subgrid on the record that lists(and be able to add/remove) all the people who have access to the record. We should also be able to report on which records a person has access to.

     

    02. Primary Limitation Two: When I share the record I have to select the permissions separately for each user I share even when I am giving them the same set of permissions on Case A. And I want to do the same sharing with let's say Case B, I have to go through and set permission for every single privilege again.

    Potential SolutionWe should be able to re-use the same permission set  with all the users we share a record and we should not have to set permissions every time we share a record with someone

    To overcome limitations users faced with the Share feature, Microsoft introduced a new type of record sharing feature called Access Team in CRM 2013. 

    Access Team in simple terms is a new type of Share feature nothing else. The name itself explains its purpose, You allow a Team (a temporary working/collaborating group of people) to Access (not to own) a particular record (not every single record) on an entity. 

    Access Team has clearly solved the Primary Limitation One i described above because you can drop a subgrid on a record form that shows all the people who have access to that record. And the subgrid also allows adding/remove people dynamically. And you can query and build reports to see who has access to the record.

    Access Team has again clearly solved the Primary Limitation Two I described above because you can use an Access Team Template to define the permissions you want to give to the people you share this record. You are not selecting these permissions for every single user you share with. And you can use the same template on any record. You are essentially re-using the permissions set you defined in the template, to every user on a record and also with any record on that entity.

    If you want two different set of permissions, you can create two Access Team templates with a different set of permissions. It is very flexible.

    I do have one negative point on Access Teams. Now that Microsoft solved most of the limitations of Share feature by introducing Access Teams but they have not made it very easy to deploy to different environments via solution.  This is one of the main reason that put some people off and they still use the Share or traditional Owner team. I hope Microsoft will make the access team enabling and team template deployment friendly.

    If you would like to read more on this topic, please follow the links below

    https://www.magnetismsolutions.com/blog/paulnieuwelaar/2013/09/12/configure-access-teams-in-dynamics-crm-2013

    https://us.hitachi-solutions.com/blog/exploring-a-new-feature-of-crm-2013-access-teams/

    https://docs.microsoft.com/en-us/dynamics365/customer-engagement/developer/use-access-teams-owner-teams-collaborate-share-information

Under review

Thank you for your reply! To ensure a great experience for everyone, your content is awaiting approval by our Community Managers. Please check back later.

Helpful resources

Quick Links

December Spotlight Star - Muhammad Affan

Congratulations to a top community star!

Top 10 leaders for November!

Congratulations to our November super stars!

Tips for Writing Effective Suggested Answers

Best practices for providing successful forum answers ✍️

Leaderboard

#1
André Arnaud de Calavon Profile Picture

André Arnaud de Cal... 291,280 Super User 2024 Season 2

#2
Martin Dráb Profile Picture

Martin Dráb 230,214 Most Valuable Professional

#3
nmaenpaa Profile Picture

nmaenpaa 101,156

Leaderboard

Featured topics

Product updates

Dynamics 365 release plans