In September, some of W-Systems’s engineers and VP of Products and Technology Bill Harrison hosted a SugarCRM training session and user group on Roles, Teams, and Portal in Sugar. The webcast wrapped up with open discussion and Q&A with W-Systems engineers Eric Wikman and Jim Rybarski. Below are some of the questions received and answers from the session.
Q: If you set access to none (roles), will that automatically disable all the functions for that module or will they be able to see the tab or will that tab be off the screen?
A: Not set basically means you can access it. It’s just a way of saying you have not restricted or particularly enabled it in any way.
Q: So they could still see that module but they wouldn’t be able to click on anything on any other records?
A: If you want to prevent someone to seeing something, you need to set it to none. But if I disable access, the person won’t even be able to see it.
Q: What does "not set" in Roles actually mean?
A1: A user can be assigned to multiple roles, and the roles can only remove access from something. So, if a user isn’t assigned to any role, they have access to every module and all the different functionalities that are there. So there are 3 options - enabled and not set are effectively the same thing, because by default you have access, so enabled is default, but not set means you’re not overriding it. So every permission on here is used just to revoke access. If you set it to disabled, you’re revoking it. If a user is assigned to two different roles - one is enabled and the other is set to disabled, then they’re effective rights are going to be disabled because the accumulation of all the different roles. Whatever role is the most restrictive setting is your effective rights. An easy way to see what a user’s effective rights are is to go to the user record, then go to the access tab, and that will show you what that end user’s effective rights are, taking into consideration all of the roles that they are assigned to.
A2. One of the distinctions between Sugar’s Community Edition and the Professional Edition, is that in the Professional Edition you actually have field level roles. So in addition to enabling or disabling a module, you can actually specify down to the individual field. None means they don’t have permission to do it at all. Not set and enabled are the equivalent which means they have access unless there’s another role that revokes it, and Owner means that they can do that action but only if they’re the assigned to user for that record.
Q: In Sugar’s roles, what are the differences between admin, developer, completely restricting, normal, user, etc.?
A: Admin can do anything, developer gives you access to studio and other things. With the admin role, team security is removed. So, admins can see every record in that module regardless if they’re on the team or not. The developer role gives them studio access. For example, if you didn’t want to give a user access to the records, but you still wanted to allow them to modify fields, then you would give them developer access.
Q: Are Roles and Teams available for all editions?
A: On the module basis, yes that can be done in all Sugar editions, including Community Edition. But the field level permissions can only be done in the Professional, Enterprise, Corporate, and Ultimate Editions. Fo team security in all editions of Sugar, a user can be assigned to multiple teams, a record can be assigned to multiple teams, and a user can see any record that’s assigned to a team in which that user is also a member of. If you’re not a member you can’t see that record, with the exception of administrators and admins for a given module can see all records in that particular module.
Q: Does edit in the accounts row allow users to delete info on the account, but not delete the account itself?
A1: That is true. You can change anything about that particular record if you don’t have complete access, but you do have edit access, so you could change any field but couldn’t delete a record.
A2: You can also use the audit field in Sugar to monitor changes.
Q: Can you be on multiple teams, and how do you add a user to a team?
A1: Yes. You can be on multiple teams. Go into the admin panel, click on user management, click on a record, click edit, and in the advanced tab you have default teams which you can change, just by clicking the plus symbol. So you can add as many teams as you want to that user and you can also modify what their default team is.
A2: A couple of other things worth mentioning - every user should be set to a private team. With the “reports to” concept in Sugar, the department manager will be assigned to all the private teams of his employees (it’s just a hierarchy, so everyone that you report to will be assigned to your private teams.) Global teams just means that everyone can see them, but you can take users off of global access.
Q: Are private teams default or are they something you have to set up manually?
A1: When you create a user in Sugar, it will automatically create the private team for them and assign it to them. Removing private teams from a user is really not an appropriate practice because if you do any kind of upgrade it’s going to add all those private teams back to those users, so what you’re really wanting to do is probably change their default team.
A2: If you assign a record to that user, but you select a team that the user is not a member of, Sugar will automatically add that private team to that user’s record.
Q: We want our people to see only the data they create and nothing that others have created. Should they be removed from the global team?
A: Yes, in that particular case. You would want to remove them from team global unless there are some records that you would like everybody to have visibility into, then you would just assign everybody to their own default private teams.
Q: How do we set a file as auditable in studio?
A: Go to the admin page, click on studio tab, click on fields, open the field. There’s an audit checkbox and it will populate the audit log anytime the field is changed. There’s also a view change log that will show any of the fields that are set to audit. The more fields you’re auditing, the longer it will take to save a record. So there’s a trade off there.
Q: We have 5 sales teams. They should not see each other’s opportunities, but they should see all contacts and accounts to avoid double entries. How do I do that?
A: You make sure that each of those records are assigned. You have 5 teams, 1 for each sales team. And each opportunity will be assigned only to that team. And you would have to make sure to remove the global team, if it’s in there by default. Just leave all the leads and contacts assigned to the global team, and that will do the trick.
Q: What is the availability of a portal?
A: Sugar Enterprise has a built in portal. The portal shown in the webcast is an example of a custom portal that can be built onto any edition of Sugar.
Q: Does Chrome work better for Sugar than Firefox?
A: Sugar’s completely compatible with Chrome, Firefox, Internet Explorer and Safari. A lot of the engineers at W-Systems have a personal preference of Chrome, though we often use Firefox when we are doing debugging because it comes equipped with cool developer tools. But that’s really just a personal preference.
Q: What are the differences in the portal features that are in Sugar Enterprise and features in custom portals?
A: Sugar provides a portal framework as part of the Enterprise Edition, which you can somewhat customize yourself. What we’re demoing is a custom portal project we have developed for the other editions that we can sell to our customers that don’t need the additional features provided by enterprise. All of the versions of Sugar have the APIs available that allow a portal to work with them. So it is possible to connect and build a portal to any version. There are many other differences that are probably beyond the scope of this conversation, but we can send out a link or feel free to contact us here.
Q: What version of Sugar was used in the demo today?
A: Sugar 6.5 and the green theme was just one of the available themes Sugar includes out-of-the-box.
Q: What fields can be edited if a user is given developer access to users, teams, roles, and modules?
A: Developer access gives them the ability to modify fields, add fields, or modify layouts for those modules.
Q: Can Roles and Teams be set for a custom module?
A: The custom modules use the exact same framework as the built-in modules, so all the concepts discussed today remain true for custom modules. So the experience should be identical from an administrative and from an end-user perspective.
If you're interested in attending future SugarCRM User Groups check our training and webinar schedule here. If you have any additional questions about Roles, Teams, and Portals in SugarCRM, contact us today.