How to restrict Resources available for selection in projects (PS2

[oldbradfordian]

Running PS2007, I need to setup security so that various department level
functional managers can access only their own resources, defined as
descendants of the user in via RBS. They should be able to view work
assignments, availability, etc in the Resource Center for their own
department members, and assign them to tasks in a project using MS Project
2007 Pro client. There are projects where they are the owner, and they use
them for future resource planning prior to committing resources to actual
development projects managed by the Project Managers. The dept managers
should not be able to build a project team, unless there is a way to restrict
their selection of resources in the team builder to only their department
members.

I have set this up, and it appears to work OK restricting the Resource
Center views to only their department resources, but when one of these
managers opens a project in MS Project 2007, the manager is able to add other
resources, that are not in his department but are in the entire resource
pool, to the Resource Sheet using the "Add Resource From Project Server"
feature. This is also in spite of the fact that the 'View Team Builder'
permission is not allowed for the department managers, and the "Build Team"
button is grayed out on PWA, but it still lets them build a team in MS
Project Pro client. Shouldn't this capability also be disabled?

How can they still be able to add resources from the entire resource pool
when I have disabled View Team Builder for them, and they are restricted to
only their RBS descendants too? What am I missing?

Thanks for any help.

 

[Andrew Lavinsky]

The managers most likely have the Assign Resource permission checked in one
of the categories - either assigned to them individually or to the group
they are in. They should have that permission only in a category that is
tied to the RBS, like My Resources or something like that.

My recommendation is to run the View Effective Rights Tool (free download)
to see what permissions are allowing it. That'll be the quickest way to
troubleshoot.

-A

 

[oldbradfordian]

Thanks for the feedback. I am still puzzled mostly by the fact the on PWA,
the "Build Team" button is correctly grayed out, and the "Resource Center"
correctly restricts the resources displayed to only those that are RBS
descendants of the user. However, when using MS Project Pro client, both
these restrictions appear to be ignored. I have re-checked my Category and
permission settings and the appear to be correct, which explains why I see
the correct behavior on PWA. Why is MS Project not following the same rules?

 

[Andrew Lavinsky]

1) Build Team is probably turned off at the server level under PWA permissions
- or the views are not accessible to the user through the category permissions.
That is correct.

2) The Resource Center is governed by the View Enterprise Resource Data security
in the categories, so it sounds like that also is correct.

3) The Project Pro resources are governed by the Assign Resource security
setting in the categories - and it sounds like that is where you have a mismatch
with your requirements. I would check anywhere you have the Assign Resource
setting in one of the categories assigned to the affected users, and see
if that is not the issue.

The View Effective Rights tool will definitely make your life much easier
for troubleshooting this kind of thing.

-A

 

[oldbradfordian]

I have revised a few settings but I still cannot get consistency between the
PWA interface and the MS Project Pro client.

Through PWA, a user can use the "Build Team" function to add resources to a
project. The resources they can select from are restricted, based on the RBS,
and the projects on which they can build a team are restricted based on the
categories the user belongs to.

However, when that same user opens the same project in MS Project Pro, then
tries to use the "Tools...Build Team" function, they see a message saying
"You do not have sufficient permissions to add enterprise resources to your
project from Project Server."

Using the Effective Rights tool isn't helping answer this question for me
either. The user belongs to two groups (lets call them group A and group B).
Group A allows the user to Build Team and to Assign Resources for a project.
Group B does not allow the user to Build Team or to Assign Resources for the
same project (the checkboxes for these functions are not checked, and they
are not explicitly denied permissions either). When I use the effective
rights tool I see the following:
"Category - Build Team on Project":
Effective Right=Deny
Group A: Object Present=True, Right=Allow.
Group B: Object Present=True, Right=(blank).
"Category - Assign Resource":
Effective Right=Allow
Group A: Object Present=True, Right=Allow.

I don't understand why the Build Team functionality is allowed through the
PWA interface but not through the MS Project Pro client application.

Any ideas where to look next?

 

[oldbradfordian]

OK - now I'm thoroughly confused!

To simplify things, I modified the user's permissions so they only belong to
one group ("Department Managers"), which contains a category ("My Department
Projects") that gives the user permissions to "Only projects indicated" (teh
list includes the "Software Development" project) and to resources where they
are descendents of the user via RBS. Now when I run the Effective Rights Tool
I get the following:

Check Permission: Build team On Project
For User: Joe Smith
On Project: Software Development
Effective Right: Allow
Object Present: True
Right: Allow
Category Name: My Department Projects
Group Name: Department Managers
Applicable Rules: Items Indicated

BUT...the user (Joe Smith) can only use the Build Team function via the PWA
interface, NOT from MS Project Pro client! Please help. What could cause
this??? Shouldn't the same permission work the same on MS Project Pro as on
PWA?

 

[Andrew Lavinsky]

The naming is a bit confusing, but:

Build Team - governs building the team in PWA.
Assign Resources - governs building the team in MPP.

So the issue is that the Assign Resources permission is set incorrectly.

What happens when you check permissions using View Effective Rights for the
resources in question using the Assign Resources permission? You should
be able to specify both the PM and the assignee to identify the relevant
permissions.

What happens when you enable Assign Resources in the My Department Projects
Category for the Department Managers group? Try it by first allowing all
resources, and then limiting them to the RBS direct descendents.

If allowing all resources to be assigned allows your PMs to assign all resources
within MPP, then I would start confirming if the RBS is set up appropriately.

-A