RBS Security in combination with Timesheet Approval Route

[Frank Jutte]

Hi,

I would like to share my experience with settin up a Timesheet Approval
Route in combination with a RBS. Before I explain my rather simple scenario I
must say that this is one of the area's in Project Server where you have to
do a lot of research on your own, there's not that much info on the net or
anywhere else that explains in detail how to handle. Anyway, this is my
scenario and solution:

1) We have a delivery manager that is the only person in the org that should
be able to approve all Timesheets
2) We have multiple Managing Consultants that have the DM as their default
Timesheet Manager, they must be able to accept Timesheets but not be able to
finally approve them
3) We have multiple Resources that each report to one of the Managing
Consultants (set by the Default Timesheet Manager property)

My RBS looks like this:

Holding
|------------Delivery Management
|------------ Managing Consultant Projects
|------------Project Managers
|------------Engineers
|------------Developers
|------------Managing Consultants Managed Services
|------------Service Managers
|------------Engineers
|------------Developers

2 specific permissions that play an important role are:
Accept TimeSheets : Both the Managing Consultants and the Delivery Manager
need this permission. Having only this permission will prevent you from final
approvement of a TimeSheet
Approve TimeSheets : Only the Delivery Manager needs this permission as this
person is the only person that is allowed to finally approve a TimeSheet
These permission will be handled by a security template that I will describe
later.

How did I set up this scenario in Project Server 2007:

Group: Delivery Management
Group: Managing Consultants
Add applicable user(s)
Add applicable user(s)
Group Global Permission: Accept Timesheets ---------------->
Group Global Permission: Accept Timesheets ---------------->
(needs to be set explicitly, even when set in a
|
|
security template, cannot
explain this but you
|
|
need it!!!)
v
v
Category: MyDirectReports Delivery Management
Category: My Direct Reports
Resource section: They are descendants of the user via RBS
Resource section: They are direct descendants of the user via RBS
Groups & Users: Delivery Management
Groups & Users: Managing Consultants (and the Resource Managers by
default)
^
^
|
|
|
|
Create Security Template: TimeSheet Manager DM
Create Security Template: TimeSheet Manager MC
Permissions: Accept TimeSheets and Approve TimeSheets
Permissions: Accept Timesheet (means you cannot finally approve a TimeSheet)

You can apply the TimeSheets by selecting the Group (or User) in the
Category, a permission grid will appear and below the grid you can choose a
security template and apply it to the group.

So in short what this set up does for you is:
It lets the Delivery Manager directly final approve TS's from the MC's
It lets the Delivery Manager indirectly final approve the TS's from other
resources in the org (1 or multiple levels below him/her in the RBS)
It lets the Managing Consultant to accept TS's from their resources without
the ability to final approve these Timesheets, Next Approver is by default
the Delivery Manager
It lets the Resources to submit TS's to their (default) Managing Consultant
TS's from the Delivery Manager will be auto approved by the system
A TS rejected by either the MC or the DM will result in returning the TS to
the resource directly.

If no fixed approval routing has been set then resources will be able to
point to another TS manager in case their default TS manager is unavailable
(holiday etc.).

Hope this explains the way you can combine the RBS with a TimeSheet approval
route. As said this is quite a challenging area in PS2007 that needs a lot of
trial and error bfore you get a grip on it. The one thing in this set up that
is not clear to me is why I have to set the Accept Timesheet permission in
the Group's Global Permission area as well as in the Security Template, I
would have thought that setting it in the Security Template (just as the
Approve TimeSheet permission) would be sufficient.

Rgds,

Frank Jutte
Winvision
http://www.winvision.nl

 

[Frank Jutte]

Hi,

Since the first posting messed up my overview I rearranged it and hopefully
it will be more clear now:

How did I set up this scenario in Project Server 2007:

Group: Delivery Management Group: Managing Consultants
Add applicable user(s) Add applicable user(s)
Group Global Perm.: Accept Timesheets Group Global Perm.: Accept
Timesheets
(needs to be set explicitly, even when set in a security template, cannot
explain this but you need it!!!)
|
|
v
v
Category: MyDirectReports DM Category: My Direct Reports
Resource section: They are descendants Resource section: They are direct
of the user via RBS descendants of the
user via RBS
Groups & Users: Delivery Management Groups & Users: Managing
Consultants
(and the
Resource Managers by default)
^
^
|
|
Security Template: TS Manager DM Security Template: TS Manager MC
Permissions: Accept TimeSheets and Permissions: Accept Timesheet
(means
Approve TimeSheets you cannot finally
approve a TimeSheet)


You can apply the TimeSheets by selecting the Group (or User) in the
Category, a permission grid will appear and below the grid you can choose a
security template and apply it to the group.

Hope this overview is now clear and gives you a complete overview of the set
up for my scenario.

Rgds,

Frank Jutte
Winvision
http://www.winvision.nl

 

[Marc Soester [MVP]]

Hi Frank,

thank you for sharing your experience, which is most helpful to all of us,
Thanks
Marc

 

[Frank Jutte]

Hi Marc,

No problem. Perhaps an additional question:

Why is it that I have to set the "Accept Timesheet" permission both at the
Security Template level and at the Group level? In my opinion linking the
security template to the category and the category to the group would be
sufficient.

Rgds,

Frank Jutte

 

[Jonathan Sofer]

You are not required to set anything at the Security Template level if you
do not wish to. The security template is simply a way to store the security
permissions settings in a place where you can easily re-apply them to your
group/categories in case you make undesirable permission changes and want to
revert back to a state in which you knew you were happy with the permission
settings.

Jonathan

 

[Frank Jutte]

In my opnion it would be most efficient to use a security template with
specific permssion. By (re)using this template in one or multiple categories
you create a low maintenance system/security setup. What I don't understand
is that when I aply the security and link it to a category I still need to
set the permission "Accept TimeSheet" at the gorup level as well (even though
this permission was set in the security template).

Any idea why this is necessary?

--
Frank Jutte
Winvision
http://www.winvision.nl

 

[Jonathan Sofer]

Frank,

Some of the permissions in the template are global permissions while others
are category type permissions. "Accept Timesheet" happens to be a global
permission so it does not apply to categories, it only applies to groups in
the global permissions section. Categories do not have global permissions
applied to them, only the category permissions.

Here is a list of all the permissions and whether they are global or
category types.

Perm Type Grouping Permission
Category Project Accept Task Update Requests
Category Project Build Team On Project
Category Project Create New Task or Assignment
Category Project Create Object Links
Category Project Delete Project
Category Project Edit Project Properties in Project Center
Category Project Manage Resource Plan
Category Project Open Project
Category Project Publish Project
Category Project Save Project to Project Server
Category Project Save Protected Baseline
Category Project View Project Details in Project Center
Category Project View Project Summary in Project Center
Category Project View Project Workspace
Category Resource Adjust Timesheet
Category Resource Approve Timesheets
Category Resource Assign Resources
Category Resource Create Surrogate Timesheet
Category Resource Edit Enterprise Resource Data
Category Resource View Enterprise Resource Data
Category Resource View Resource Assignments in Assignment Views
Global Admin About Microsoft Office Project Server
Global Admin Clean up Project Server database
Global Admin Manage Active Directory Settings
Global Admin Manage Check-Ins
Global Admin Manage Cube Building Service
Global Admin Manage Enterprise Calendars
Global Admin Manage Enterprise Custom Fields
Global Admin Manage Gantt Chart and Grouping Formats
Global Admin Manage Notification and Reminders
Global Admin Manage Project Server Backup
Global Admin Manage Project Server Restore
Global Admin Manage Project Web Access Views
Global Admin Manage Queue
Global Admin Manage security
Global Admin Manage Server Configuration
Global Admin Manage Server Events
Global Admin Manage Status Reports
Global Admin Manage Users and Groups
Global Admin Manage Windows SharePoint Services
Global Admin Save Enterprise Global
Global General Change Password
Global General Contribute to Project Web Access
Global General Download PWA Outlook add-in
Global General Log on
Global General Log on to Project Server from Project Professional
Global General Manage Lists in Project Web Access
Global General Manage Personal Notifications
Global General New Task Assignment
Global General Reassign Task
Global Project Build Team On New Project
Global Project Change Project state
Global Project Create New Proposal or Activity
Global Project New Project
Global Project Open Project Template
Global Project Save Project Template
Global Project Save Unprotected Baseline
Global Resource Manage Resource Notifications
Global Resource New Resource
Global Resource View Resource Plan
Global Status Reports Edit Status Report Requests
Global Status Reports Edit Status Report Responses
Global Time and Task Mgmt Accept Timesheets
Global Time and Task Mgmt Close Task to Updates
Global Time and Task Mgmt Manage Rules
Global Time and Task Mgmt Manage Time Tracking
Global Time and Task Mgmt Manage Timesheet and Financial Periods
Global Time and Task Mgmt Self-Assign Team Tasks
Global Time and Task Mgmt View Resource Timesheet
Global Time and Task Mgmt View Surrogate Timesheet
Global Views View Approvals
Global Views View Data Analysis
Global Views View OLAP Data
Global Views View Project Center
Global Views View Project View
Global Views View Resource Availability
Global Views View Resource Center
Global Views View Task Center
Global Views View Team Builder
Global Views View Timesheet Center

 

[Gary L. Chefetz [MVP]]

Frank:

You use security templates to assign rights once. These are not dynamically
linked. The only time the template has any impact is when you apply it. So,
you don't need to ever apply the change to the security template, but if
that template represents your standard, you can use it as a way of saving
the "state" of those settings.

--

Gary L. Chefetz, MVP
MSProjectExperts
For Project Server Consulting: http://www.msprojectexperts.com
For Project Server FAQS: http://www.projectserverexperts.com