Users with same BU, Teams, and Security Roles have different permissions

(0) Share

Report

Posted on by Nuno

2,005

Hi,

I have two users which belong to the same business unit, to the same teams and they have assigned the same security roles, however one of them is able to edit one account and the other only is able to read it. How is this possible?

There is no JavaScript either business rules to change the permissions of the record.

Beyond business units, teams and security roles what I have to check more regarding users permissions on a record?

Thanks

*This post is locked for comments

I have the same question (0)

All responses (10)

Answers (1)

a33ik 84,331 Most Valuable Professional on at

Like (1)

Report

Hello,

Have you checked sharing of record?

Was this reply helpful? Yes No
Community Member on at

Like (0)

Report

Also, if you have hierarchical security set up, they could be getting edit access through one of their direct reports.

Was this reply helpful? Yes No
KG_CRM on at

Like (0)

Report

Who owns the Account and what Business Unit is that user is? If your users only have User-level access to Write to Accounts then only the owner of the Account can edit it.

Was this reply helpful? Yes No
Suggested answer

Harish Das on at

Like (0)

Report

Hi

in this scenario you have to set the owner for the account record.

and in the security role, you have to enable edit permission for account entity at user level.

Once you have done this configuration. owner of the account record can edit the account, other user of same team will have read permission.

Let me know if this suggestion will work to achieve your requirement.

Regards

Harish

Was this reply helpful? Yes No
Community Member on at

Like (0)

Report

Thanks Harish, you are correct. However, based on his profile, Nuno is familiar with the fundamentals of Dynamics CRM.

Nuno, an associate of mine ran into a similar scenario. She never figured out the cause, but she managed to resolve it by removing the security roles from the users, and re-adding them.

Was this reply helpful? Yes No
Suggested answer

PS 23,577 on at

Like (0)

Report

Hi Nuno,

Explaining below with an example:

Lets say you have two users named A and B; both belongs to a Business Unit(BU) called Portugal and have 'salesperson' security role.

In 'salesperson' security role following are the privileges for account entity:

User can create, write/edit his/her own record and read records of the BU.

So lets say, there is an account called 'Palmolive' created by user B. This account would be visible to both the users A&B but can be edited only by user B (as B is the creator). There is another account called 'Unilever' created by user A. This account would be visible to both A&B users but can be edited by only A (as A is the creator). To understand more about security roles and permissions, please visit the following URL:

crmbook.powerobjects.com/.../security-roles

If they belong to a team and the account is owned by Team A&B, Team must have account write permission at BU level, so that both A&B can edit the record.

Was this reply helpful? Yes No
Shiva.B 150 on at

Like (0)

Report

Hi Nuno, with Access team we can give the permissions to user without considering the Role based security, User may have this Access team privileges

Was this reply helpful? Yes No
Nuno 2,005 on at

Like (0)

Report

Thanks a lot everyone for your answers, but so far none have solving the problem.

I will try to explain a bit better the issue I am facing:

There are two users (here named user A and user B). As both users belong to the same business unit and same teams and have assigned the same security roles, it is expected they have the same privileges over the same CRM records.

Although the user A may read and write an specific account and the user B is only able to read it. This account is owned by other user (user C).

The footer of the account record for the user A shows the user is able to write it:

The footer of the account record for the user B shows the user is not able to write it:

I also have executed the RetrievePrincipalAccessRequest message. This request received the guid of a principal (user or team) and the guid of a record, and tell us the privileges that principal has over the record and as expected both users have the same privileges (next is the response).

User=A;AccessRights=ReadAccess, WriteAccess, AppendAccess, AppendToAccess

User=B;AccessRights=ReadAccess, WriteAccess, AppendAccess, AppendToAccess

So, it is pretty weird the account form is different. Can it be some issue regarding to browser cache?

Thanks,

Was this reply helpful? Yes No
Suggested answer

Tushar2016CRM 1,130 on at

Like (0)

Report

HI ,

This may only be possible if User C has shared the access with user A .

Else you may have a Team where User A and C are associated and User B is not .

Thanks !

Was this reply helpful? Yes No
Verified answer

Nuno 2,005 on at

Like (0)

Report

I have solved the issue.

The user A had the Access Mode set as Read-Write and the user B as Read. Changing the access mode of the user B to Read-Write solved the problem.

Thanks everyone for the help

Was this reply helpful? Yes No