Project Server 2013: I am using Project Server Permission Mode and need help with permission assignments?

Question

Hi 
Project Server 2013: I am using Project Server Permission Mode and need help with permission assignments?
How can I change Permissions for the individual users to see specific projects or all projects in project center and to see specific quick launch items?
For Example: if i have 4 users, A, B, C and D. what i want is:
User A can see everything and act as a project manager or Admin.
User B can view all projects in project centre but can change the schedule or resource assignment etc.
User C can only act as approver of projects and can view all projects in project centre.
User D can only view specific projects for which permissions are given.
can i have some expert help in sorting and understanding permission modes... as i was playing with project server mode permissions and can't figure out how to apply the above scenario to set of my user.
Thanks in Advance
Cheers
AJ
Ajay Kumar

Answer 1

Hi Ajay,
Please refer to this link for detailed explanations about PS2013 security model. 
http://technet.microsoft.com/en-us/library/cc197638(v=office.15).aspx
Actually, it will take a couple of days to explain in detail the security model that is a fundamental and tricky aspect of every PS implementation. But basically, you NEVER set permissions for a single user. You have groups in which your insert users. Groups
define "what users can do". Then you associate groups to a corresponding category. Categories define "what user can see". Thus the association of a group with a category will set "what the user can do on the objects he can see". Then, for more advanced security
level, you can use the RBS that will consist in "branches" in which you'll insert users. Based on those branches, you'll customize categories to fine-tune what user can see (for projects and resources) depending on the RBS branch and level.
I'd advice you to start "playing" in a test environment with the default categories/groups that might probably cover your need.
Concerning your 4 users:
user A : add him to the "administrator" group. Be careful that you're mentionning either project manager or administrator, which are 2 groups/categories with totally different permissions level.
user B : basically can see everything and change everything? it could be in the project manager group, assuming that there are no project visibility restrictions on the category via the RBS.
user C : waht do you mean by "approver"? Workflow approvals? Then it will be the portfolio manager group. Task update or timesheet approval? Then it is another long topic: please refer in the documentation to the "status manager" and "timesheet manager"
concepts. There are not related to the security model. In a few words, the status manager is the owner of the project plan, is defined for each task and approves tasks updates. The timesheet manager is an attribute defined for each resource in its parameters
and approves resource timesheet.
user D : you have to define which permission level must be given to this user. Basically it could be a team member that will see only projects he's in the project team. Note that team member cannot interact with the project plan in another way than submitting
timesheets and/or tasks updates which must be approved.
Once more, those are large and complex subjects that require a deep dive into your business model and tons of tests in a test environment.
Hope this helps.
Guillaume Rouyre - MBA, MCP, MCTS