How to secure PSA detail like time entries, approvals and actuals?

(1) Share

Report

Posted on by Marcel Lathouwers

175

We have PSA (v3) setup in an customer environment that needs to protect project information from users. So we created business units and gave users roles with max priveliges on bu level.

Unfortunately a lot of records that PSA creates eg approval and actuals are created and owned by user SYSTEM and thererfor in the top BU. The users belonging to a child BU will not be able to see the actuals for there project.

I'm suprised that MS has intorduced a 'all or nothing' principle. Is there a supported way to deal with tighter security, but still all functionality in place, like approving, invoicing, credit invoicing?

apa

I have the same question (0)

All responses (4)

Answers (0)

Sort by

Community Member on at

Like (0)

Report
Copy link

Link copied!

Hi Marcel,

Maybe you can share these records with users or teams:

Dynamics 365: Share and Share Alike - CRM Software Blog | Dynamics 365

Was this reply helpful? Yes No
Suggested answer

Thomas Schick 4 on at

Like (1)

Report
Copy link

Link copied!

Hey Marcel,

You are completely right in that the PSA solution is not business unit-aware. I was facing the same issue a couple of years ago and went as far as creating a support ticket with the PSA Team. They told me they are aware of the issue and would rethink their position (they didn't).

I would not recommend using the sharing functionality in this case (or at all). It is cumbersome and bad for performance, as it creates records in the Principal Object Access table, which have to get checked every time a Retrieve is performed in the system. The bigger this table gets, the worse the overall system performance becomes. Sharing creates tons of records in the POA.

For these tables where SYSTEM becomes the owner, I recommend creating Flows/Workflows/Plugins that assign the records to people based on your business logic. For example, actuals in our system get assigned to the project manager that is set in the project. Same with project approvals.

Hope I could help,

Thomas

Was this reply helpful? Yes No
Marcel Lathouwers 175 on at

Like (0)

Report
Copy link

Link copied!

Thx Thomas Schick, we were on the same road, but wanted to check to be (more) sure.

Was this reply helpful? Yes No
Marcel Lathouwers 175 on at

Like (0)

Report
Copy link

Link copied!

Thanks for suggesting, but it would probably create a performance nightmare on the POA table

Was this reply helpful? Yes No