Module 02 - Building a Security Model in MSDynCRM2013

Question 1

What is a key objective of any security model?

Answer 1

Prevent unauthorized access or modifications to data.

Question 2

Security rights that you configure in CRM also has a direct effect on what?

Answer 2

Affects the way she system behaves and is displayed to the user.

Question 3

If a user does not have access to a specific entity or application feature…

Answer 3

They are simply not visible in the user’s interface.

Question 4

CRM uses a role-based security model.

Answer 4

Meaning, permissions are defined for a specific job role that is then assigned to users or Teams.

Question 5

Business Units define…

Answer 5

A hierarchy of Users and Teams. And the records the Users and Teams own.

Question 6

Security Roles define…

Answer 6

The privileges the Users and Teams should be granted.

Question 7

Being able to apply permissions on records allows users to…

Answer 7

Perform different actions on records that are owned by other Users or Teams in their Business Unit, from the actions they can perform on records located in another Business Unit.

Question 8

Business Units are helpful to reporting, how?

Answer 8

As an example, a single report can be used by several users in different Business Units to receive the results. Records reflected in the report only include the records that a user has access to.

Question 9

What is the root Business Unit?

Answer 9

The first Business Unit is generated by the deployment process when the Organization is created.

Question 10

Business Units are often created to reflect…?

Answer 10

The operational reporting hierarchy of the business separated by geography or function, or a combination of both.

Question 11

What can the root Business Unit represent?

Answer 11

Can represent the corporation or the holding company of all Business Units in the organization. It is the upper-level node of CRM organizational hierarchy.

Question 12

What are some key characteristics of the root Business Unit?

Answer 12

There is only one root Business Unit. It is created by the CRM Server Setup program. Cannot be assigned a parent Business Unit. Cannot be disabled or deleted.

Question 13

What can Business Units represent?

Answer 13

Subsidiaries, divisions, departments, or just groups of users that have other commonalities such as skills or responsibilities.

Question 14

You should design the Business Unit hierarchy to support what?

Answer 14

The reporting and access requirements, instead of copying the organization chart.

Question 15

How do you create a Business Unit?

Answer 15

CRM > settings > administration > business units > new > enter name > parent business selection > complete other properties > save and close record.

Question 16

Which field is required for any Business Unit you create?

Answer 16

Parent Business field. The root Business Unit does not require a parent.

Question 17

How do you modify a Business Unit?

Answer 17

CRM > settings > administration > business units. –> change parent business to change location in hierarchy, or other properties.

Question 18

When you change the Parent Business Unit of a Business Unit to reorganize your structure, what rules apply?

Answer 18

When a Business Unit is reassigned to a new parent, all its child Business Units move with it. You cannot create circular relationships.

Question 19

What might you have issues with when you move a business unit?

Answer 19

You might have issues with Security Roles assigned to a User or Team. Only security roles locally defined in the Business Unit will remain. Inherited security roles will be removed.

Question 20

When would you want to Disable a Business Unit?

Answer 20

For example, it temporarily stops operation. It will disable all child Business Units and users attached to these Business Units.

Question 21

Users who are assigned to a disable Business Unit cannot access CRM but what happens to the data?

Answer 21

No data is lost. As soon as a BU is enabled, the disabled users can access the aplication again.

Question 22

All enabled users who are assigned to an enabled Business Unit can access…

Answer 22

CRM.

Question 23

A disabled user is not enabled when his or her Business Unit is…

Answer 23

Enabled.

Question 24

How to enable or disable a Business Unit?

Answer 24

Settings > Admin > Business Units > select Business units > More actions menu to click either Enable or Disable > OK

Question 25

How can you permanently delete a Business Unit?

Answer 25

You must disable it first and remove any child Business Units, Users and Teams.

Question 26

How can you remove child Business Units, Users and Teams?

Answer 26

Either by reassigning Business Units, Users and Teams individually to a new parent, or deleting Business Units or Teams (users cannot be deleted).

Question 27

What are you unable to delete when attempting to delete a Business Unit permanently?

Answer 27

The Users, and the default Team of the Business Unit cannot be deleted.

Question 28

If you want to keep Facility/Equipment records and Resource Groups, you must?

Answer 28

Move the sources to a different Business Unit as they will be deleted when the Business Unit is deleted.

Question 29

Best Practice for deleting Business Units?

Answer 29

Should disable Business Units instead of deleting them. Deleting is irreversible.

Question 30

How to delete a Business Unit?

Answer 30

CRM > Settings > Administration > Business Units > Inactive Business Units > make sure all users, child Business Units and Teams (except default) are removed > Delete > Confirm deletion.

Question 31

In order to access the system, each user must be assigned what?

Answer 31

A security role.

Question 32

How do users receive their permissions to work on records or use features?

Answer 32

It is based on the combination of security roles they are assigned and the business units to which they belong.

Question 33

What are Teams used for?

Answer 33

Teams are used to group users together from one or more Business Units for reporting purposes or to grant the Users the permissions that are given to the Team.

Question 34

What happens if a team has one or more Security Roles?

Answer 34

Users who are members of the Team can use these privileges and the permissions from their own Security Roles.

Question 35

Users can share a record with a Team or assign a record to a Team to own the record if?

Answer 35

The Team has at least read access to the entity.

Question 36

How to give the User permissions required based on primary/secondary/temporary/project role?

Answer 36

Layering multiple roles and permissions assigned directly or indirectly to the User.

Question 37

A Security Role is created in and remains, where?

Answer 37

In a Business Unit.

Question 38

What happens when a Security Role is created?

Answer 38

The Security Role is copied to the child Business Units of that Business Unit and down the hierarchy.

Question 39

What are the copies of the Security roles called?

Answer 39

Inherited roles, which cannot be modified or deleted. If original role is modified, the configuration is copied down so copies always replica of original.

Question 40

A Solution can only contain Security Roles that are created in...?

Answer 40

The root Business Unit.

Question 41

What happens to Security Roles when a solution package is imported?

Answer 41

Security roles are created in the root Business Unit of the target system or update an earlier version of the same if it it already exists. Inherited roles are then created or updated in all BUs of the target Organizations.

Question 42

Users and Teams can only be assigned to a Security Role in their own Business Unit, so that inherited roles make it easier to...

Answer 42

Assign the same privileges to users in different Business Units without having to create and maintain matching roles.

Question 43

It is recommended that Security roles are created where and why?

Answer 43

In the root business unit, and use inheritance to create copies in other Business Units, to avoid having security roles with matching names but completely different permissions and similar issues.

Question 44

What is a best practice concerning the creation of security roles?

Answer 44

It is recommended that you create copies of the default roles and configure the copies to meet your exact security requirements instead of assigning the default roles directly to Users and Teams.

Question 45

Why is creating copies of the default roles useful?

Answer 45

You can keep them as a reference, and you can delete them later on and only use the ones you have modified.

Question 46

Which security role are you unable to modify, ever?

Answer 46

The System Administrator role.

Question 47

What special properties does the System Administrator role have?

Answer 47

All privileges to all entities and features at the Organization access level even as new custom entities are created. At least one user must have the role. Cannot be disabled. And users who have this role are members of the System Administrator Field Security Profile.

Question 48

What happens if you make a copy of the System Administrator role?

Answer 48

It makes a copy and creates a role that has "nearly" all the privileges, but the copy of the role will not have special properties.

Question 49

What are privileges?

Answer 49

Basic security unit in CRM. Describes the actions that are allowed at a selected access level.

Question 50

What are access levels?

Answer 50

Describe where the privilege applies.

Question 51

What do security permissions in each Security Role consist of?

Answer 51

Privileges.

Question 52

What are entity privileges?

Answer 52

Every security role includes a grid that shows the privilege for every combination of each entity and the actions that can be performed on its records.

Question 53

Explain the Create Privilege.

Answer 53

User can create records of the entity.

Question 54

Explain the Read Privilege.

Answer 54

User can read records of entity.

Question 55

Explain the Write Privilege.

Answer 55

User can update data for records of entity.

Question 56

Explain the Delete Privilege.

Answer 56

User can delete records of the entity.

Question 57

Explain the Append Privilege.

Answer 57

User can attach this entity to other records.

Question 58

Explain the Append To Privilege.

Answer 58

User can attach other records to this entity.

Question 59

Explain the Assign Privilege.

Answer 59

User can make other Users or Teams the owner of this entity.

Question 60

Explain the Share Privilege.

Answer 60

User can share records of the entity with other Users or Teams.

Question 61

Privileges can be granted at different access levels for what reason?

Answer 61

To define the records of the entity that the user can perform that action against.

Question 62

Why don't Organization-owned entities have privileges to Assign or Share?

Answer 62

It only applies to entities owned by Users or Teams.

Question 63

Access Levels indicate what?

Answer 63

The records of each entity on which the User can use a privilege.

Question 64

What two access levels exist for Organization-owned entities?

Answer 64

None and Organization.

Question 65

Access level NONE means?

Answer 65

User does not have the privilege.

Question 66

Access level USER means?

Answer 66

User has privilege for records they own and for records shared with user either directly or through Team membership.

Question 67

Access level BUSINESS UNIT means?

Answer 67

The user has the privilege on all records that are owned by members of his or her Business Unit. Does not have permissions on records owned by members of child Business Units.

Question 68

Access level PARENT:CHILD BUSINESS UNIT means?

Answer 68

The user has the privilege on all records that are owned by members of his or her Business Unit, and all records owned by members of child Business Units to any depth.

Question 69

Access level ORGANIZATION means?

Answer 69

User has privilege on all records in the organization.

Question 70

What is the entity (row) or privilege (column) shortcut method?

Answer 70

You can click the labels to modify a whole row or column at one time. Level cycles round together.

Question 71

There are some privileges for which some levels are not available. Explain.

Answer 71

Entities such as User, Team, Facility/Equipment can have privileges that are set to anything except User level because these entities are not user owned, they are BU owned. Saved Views and User Charts can only be saved to User level or none (these aren't entities though).

Question 72

Miscellaneous privileges relate to ...?

Answer 72

Application features such as Print, Merge, Export to Excel and Go Offline. These privileges apply to features globally.

Question 73

Miscellaneous Privileges that related to records have how many access levels?

Answer 73

Have the usual five, due to their relation to records.

Question 74

UI reflects current privileges, meaning?

Answer 74

Buttons are not shown for actions that a user does not have the privilege to perform.

Question 75

If a user is assigned two or more Security Roles, what happens?

Answer 75

The privileges are additive, and the highest access level applies (least restrictive security model).

Question 76

If you modify an existing role, what will happen?

Answer 76

Any users assigned to that role will have their privileges updated as soon as you save or import.

Question 77

When you create a copy of a role, you can...?

Answer 77

Specify a new name, but not a new Business Unit. The copy will be in the same BU as the original.

Question 78

Is there a link between a copy and the original?

Answer 78

No. Changes in original are not reflected in the copy.

Question 79

What is an advantage of copying a role?

Answer 79

You can directly compare the copy and the original as you make or document your changes.

Question 80

When is it a better choice to create a completely new role?

Answer 80

When the role only has a few privileges specified to use as an additional role layered over a main Security Role assigned to a User.

Question 81

To modify an existing role, what are the steps?

Answer 81

Settings > Administration > Security Roles > Business Unit dropdown list, select Business Unit where the role to be modified exists > Modify > Save and Close

Question 82

To copy a role, what are the steps?

Answer 82

Settings > Administration > Security Roles > Business Unit drop down list > Select Security Role to be copied > More Actions > Copy Role > OK

Question 83

To create a new role, follow which steps?

Answer 83

Settings > Administration > Security Roles > New > Role Name field fill > Business Unit lookup field, select BU > Configure privileges and access levels > Save and Close

Question 84

Can Security Roles be moved from one Business Unit to another?

Answer 84

No. You'll have to delete and recreate in the proper BU if you made a mistake.

Question 85

The Manager field...

Answer 85

Is optional. Must be located in the same Business Unit as the User, or above the User's BU in the hierarchy.

Question 86

What kind of user maintenance functionality does CRM provide?

Answer 86

Create/enable/disable users, identify managers, create/delete teams, assign users to teams, assign security roles to users and teams, move users and teams between business units.

Question 87

You cannot delete Users but you can?

Answer 87

Disable an account if member of staff has left organization, and user no longer requires a user license. Records are still available and should be reassigned.

Question 88

What is a Team?

Answer 88

A group of users who work together for a long time, such as a department of an org or a project team.

Question 89

What is an Owner Team?

Answer 89

Can be assigned Security Roles and own records.

Question 90

What is an Access Team?

Answer 90

Cannot have security roles, cannot own records, but records can be shared.

Question 91

Owner Team can be converted to an Access team, but...?

Answer 91

Not the other way around.

Question 92

Advantages of a team?

Answer 92

- Faster information sharing- Implicit sharing dynamically applied to Users added and removed- Security roles can be granted to an owner Team and layered- Can be used for querying and reporting. - if owner team has role granting user level read access, team can own records for that entity- team can be linked to a queue

Question 93

What is the default team?

Answer 93

When you create a Business Unit, a Team is automatically created in the Business Unit with the same name.

Question 94

What can you or can't you do with the default team?

Answer 94

Default team cannot be deleted, renamed, moved or have its membership modified. But you can assign security roles to the default team.

Question 95

A security role assigned to a team ...

Answer 95

Can be used by members of the Team.

Question 96

When a security role is assigned to a team, the access levels are in relation to the what?

Answer 96

To the Team and not the User.

Question 97

When you create or manage Teams other than the default, what should you remember?

Answer 97

- Every team is associated with one Business unit. - Teams can contain users are members. Not other teams. - Users can belong to more than one Team. - Though a Team is associated with a BU, users can be anyone regardless of BU. - Sharing a record with a Team shared it indirectly with all users in that Team.

Question 98

How do you create a new team?

Answer 98

Settings > Administration > Teams > New > Fill out fields in Tab.

Question 99

How to add users to a Team record?

Answer 99

You can do it through the Team record, or through the User record.

Question 100

To add users to a Team?

Answer 100

Settings > Administration > Teams > Local Business Teams > Add members.

Question 101

To manage a User's membership?

Answer 101

Settings > Administration > Users > Teams > remove > add existing team > Look up more if necessary.

Question 102

What is Sharing and why is it useful?

Answer 102

It gives another User or Team specified access to a single record, useful when you want selected Users from other Business Units to work on records they don't have access to.

Question 103

Sharing a record with a Team is equivalent to...?

Answer 103

Sharing with all the Users in the Team.

Question 104

Sharing with a Team is generally better for performance because...?

Answer 104

Shares are stored as records in the SQL database, so it provides better system performance than when shared with users due to fewer records being created in the table, and thus table is queried more efficiently.

Question 105

Users can share...?

Answer 105

Personal views from Saved Views, Personal charts from More Actions and Personal dashboards from More Commands.

Question 106

Why is it important for Users to understand that components like views that are shared with a Team are not copies?

Answer 106

The components are a single view, chart, dashboard all will use. If one changes it, it will be modified for all. The one sharing can choose to allow others read only, or change depending.

Question 107

Sharing records, steps?

Answer 107

Navigate to record > More commands > Share > Add user/team > select > OK

Question 108

When granting permissions through sharing, a user must have at least User level for a privilege through a security role...

Answer 108

before share granting corresponding permission will take effect and allow access.

Question 109

The Append privilege assigned through sharing applies to both?

Answer 109

Append and Append to privilege in Security Roles.

Question 110

Sharing a record with a team shares record with all users of that Team. Therefore...

Answer 110

This grants access to Users who are added to the Team later and removes access from Users who are no longer in the Team.

Question 111

When a record is shared with a BU's default Team...

Answer 111

This effectively shares the record with all Users in that Business Unit.

Question 112

Privileges granted by sharing a record do not apply unless?

Answer 112

The recipient has at least the User level access for that permission through his or her Security Roles. Meaning, user cannot have more privileges to a shared record than the user has for his or her own records of that entity.

Question 113

Manage User Roles dialog box will show the roles a User already has and can add or remove roles here. What happens if you select more than one user?

Answer 113

Current roles will not be shown, even if they have the same roles assigned. You can only use this method to add more roles to multiple people at the same time, not remove.

Question 114

Every User and Team in CRM belongs to a single BU, can you move Users or Teams to different BUs?

Answer 114

Yes.

Question 115

What is a best practice concerning the moving of Users and Teams?

Answer 115

After you move a User, assign new security roles to the User. If you move a Team that has a security role assigned, you will also have to reassign appropriate roles.