Support Portal ContactGet in touch

Sharing in Dynamics

   Words by Paul McQuillan

   on 07/02/2018 18:00:00

When working with Security in Dynamics CRM, we can sometimes hit the problem of ‘why am I seeing this record?’

This is where a record appears to a User, but it is not immediately obvious why the User has access to see the record – particularly when the User is limited to only viewing records they own, or that are in their Business Unit.

When this happens, we have three things to think about:

  • Is the record shared with me?
    • The most obvious explanation is that the record has been shared with my User Account, and this grants the User access to the record even if the record is owned by another User or even a different Business Unit.
    • We can see this Sharing by clicking the ‘Sharing’ icon for the record.
  • Am I member of a Team that is giving me additional Security Rights
    • The User can become to any number of Teams, and each Team can be associated to 1 or more Security Roles that work to grant all the Users in that Team certain rights.
    • So the User might be seeing the record because the Team is granting them rights beyond their basic User Roles.
  • Has Dynamics done some ‘secret sharing’
    • CRM has some rules where the system will automatically share a record with you or another user; and this can sometimes perform a share behind the scenes to give us access to a record.

Automatic Sharing - Turn it off?

We can deactivate this automatic sharing by accessing Administration of our CRM, and then into System Settings:

clip_image002

In here, we can see the option for ‘Set whether reassigned records are shared with the original owner’.

clip_image004

If this option is set to YES, then any Task or other record that we reassign to someone else will automatically be shared with me so I do not lose access to the record.

So the Task or Opportunity will remain accessible to me, even through I am no longer the Owner.

If we want CRM configured so that the Task or Opportunity record disappears from my access as soon as I reassign to another User, then we can set this to NO.

This means that I will lose access to any records once I have reassigned them – if my Security Role limits me to records I own.

How does this work?

This functionality prompts CRM to add a Row to the PrincipleObjectAccess Table whenever a Record is reassigned – adding a record to denote the Sharing after the reassignment.

This can be ‘hidden’ sharing as the record added to the PrincipleObjectAccess Table is only available by a direct SQL Query or an SSRS Report – and not generally available in the standard Dynamics Sharing View.

However if we are working with an On-Prem or Partner Hosted Build of Dynamics, then we can see this Sharing being added to the PrincipleObjectAccess Database Table (and associated views) to review what Dynamics is up to here.

What is the Principle Object Access Table?

https://community.dynamics.com/crm/f/117/t/218848

  • "Paul has made a real difference to how my team of 24 people record and store valuable customer data and sales opportunities. Highly recommended."

    James, Operations Director

  • "Understanding your business allows us to advise when to implement aspects of CRM and, likewise, when not to."

    Paul McQuillan, Managing Director

  • "Dynamics 365 and CRMCS have made a real lasting difference to our business, allowing us to replace older systems that were holding back our performance."

    Grahame, Chief Operating Officer

  • "James worked well with us to help connect CRM with Outlook and relate how this might benefit our team using CRM for Property Care."

    Natalie, Property Care Supervisor

  • "Matt was really good with helping us run User Testing on the new Compliance Module of our CRM System."

    Tom, Compliance Administrator

Prefer to go old-school?

Write to us using the below addresses.

Head Office
CRM Consultancy
61 Oxford Street
Manchester
M1 6EQ

London Office
CRM Consultancy London
Grosvenor Avenue
London

Content © CRM Consultancy.