I recently received this question from a reader:
I’m working with an on premise 2011 client. I’ve created one parent and three child BU’s. I have created three different forms for 4 entities and want the forms to be shown based on the security roles from the child BU’s, but whenever I go to assign them through the form I cannot see any roles but those of the parent. I feel I’m missing a step, but don’t know where I’ve gone wrong. Can you point me in the right direction?
Good question – I wondered about that myself the first time I noticed it!
The problem is, when you assign security roles for a custom form, the only available security roles are those from the root business unit! Since you cannot target forms directly to security roles for a child business unit, the best solution I’ve found so far is to create custom security roles in the root business unit, target the forms of interest to those security roles only, and then make sure that the folks in the business unit who need to see the custom version of the form have those security roles assigned to them.
The following figure shows two custom forms for the opportunity entity, East and West. (The organization has two child business units with the same names):
If you select one of the custom forms and click Assign Security Roles, at first you see this:
Notice there’s no way to select a child business unit. That’s the correct observation of the blog reader who asked the question. Suppose I create two custom security roles, “East Business Unit” and “West Business Unit”. A couple of points about these custom security roles:
- To serve the purpose we need them for here, they need to be in the root business unit, but I’ll name them that way to indicate what they’re for.
- They also do not need much in the way of privileges, and in particular I don’t want them to elevate anybody’s security privileges (or at least, not much!). I’ll create them by copying the Salesperson security role.
After doing that and opening up the Assign Security Roles for the form again, I’ll see the new security roles. Here I’ll assign the East Business Unit security role to the East version of the form:
And then, for the default version of the form (I changed the name from the bland “Information”), I’ll change the Display to option so it only displays for System Administrators:
We’re almost done, but not quite: how do we push that custom East Business Unit security role out to the users in the East business unit? Assuming everybody in the business unit should see the same version of the form, the easiest way to do it is by taking advantage of the default team for the business unit, and assigning the security role to it.
Default teams for business units are new in CRM 2011, and have several advantages for an application like the one we’re discussing here. In particular, since every user assigned to a business unit is automatically assigned to (and cannot be removed from) the business unit’s default team, we know that assigning the security role to the default team will push any of its privileges (including ones to custom forms as in this example) will work.
So, select the default team for the East business unit, and click Manage Roles. Then select the custom East Business Unit security role, click OK, and we’re done:
Now, all users in the East business unit will see the custom version of the form, and the other security roles they have will determine whether they can see other versions of the form.
