Unable to assign all security roles to a user with a new custom security role

Dear All,
Happy New Year.!
I have a query regarding the assignment of Security Roles to new users in CRM. Normally we assign the security roles to new users via an Admin user who has 'System Administrator' security role assigned to him/her. This works perfectly fine, and we can assign
any desired security role to the new user.
However, in our case, we need to delegate the user creation rights to some of the client partners. We do not want to give them access to all the Administration functions; hence we created a new Security Role, lets say 'Support User Role'. We have provided
'Create', 'Append', 'Append To', and 'Assign' rights on 'User' entity for this new security role. With this security role, we are able to create new users now, but we are only able to assign 'Agent' security role, not any other security roles.
For example, if user 'x' has Security Role defined as 'Support User Role'. If 'x' tries to add a new user 'y', then 'x' is only able to assign 'Agent' security role to 'y', but not any other security role. As per business requirement, 'x' should be able
to assign some other security roles, including 'Support User Role', to new user 'y'.
I believe that there is something missing in Security Role configuration, which is causing the above problem. We compared both 'Support User Role' and 'System Administrator' security roles, but not able to figure out which minimum rights we can provide to
'Support User Role' so that users with this security role can only add new users (with any security role), and that they are not having access on any other Administration features as well.
Appreciate any help that you can provide on the above issue.
Thanks in anticipation.

Hi,
Can you check if you have organization level Read access for Securitity Role and Organization level Assign access for Security role.
Refer:-
http://www.magnetismsolutions.com/blog/paulnieuwelaar/2013/04/22/permissions-required-to-manage-roles-in-dynamics-crm-2011
Hope this helps!!!
Thanks,
Prasad
Make sure to "Vote as Helpful" and "Mark As Answer",if you get answer of your question

Similar Messages

  • Short cut assign all transactions code to a user, restrict only few tr code

    Hi,
    I know how to assign transaction code to user, and restrict transaction codes to the user through pfcg assigning role.
    If I want to assign all transaction codes to a user except say su01, and pfcg, then I have to write all the transaction codes to a profile assigned to the user except pfcg and su01, which is a tedious job.  Thus is there any way like in sap_all if I can exclude only those transaction codes which I want to exclude to a user. 
    No one would like to write down 1000 tr code assigned to a user. Is there a short and better way?
    Thanks
    syed

    Create a new role using PFCG go to the authorization tab and use the sap_all template and remove the authorizations for the transaction you don't want to assign.
    Thats it
    Regards
    Juan

  • I just want to see my files with explorer.  Then transfer all pics to my computer. With the new update I can't.   How do I access my file with just explorer?

    I just want to see my files with explorer.  Then transfer all pics to my computer. With the new update I can't.   How do I access my file with just explorer?

        Let's bring back your file control, jpandwibble. What happens when you connect to your computer? Are you trying to use Explorer on the device or on computer? I am eager to continue troubleshooting!
    Thank you,
    YaleK_VZW
    Follow us on Twitter @VZWsupport

  • This morning I changed my Apple ID to my new email address.  I thought it meant that I could then use all my alias icloud email addresses with my new Apple ID because it would be the same account.  Why am I now not getting email to those addresses.

    This morning I changed my Apple ID to my new email address.  I thought it meant that I could continue to use all my alias icloud email addresses with my new Apple ID because it would be the same account.  Since then I have not received and new emails to my iCloud email addresses.  Normally I get at least  7 new emails a day, so I'm pretty sure my iCloud addresses are not working.  It would be a lot of work for me to notify a lot of people, companies, and organizations about new email addresses, so I really would like to make them work.  Will it be possible to make them work with my new Apple ID?

    Roger, I didn't know that "Delete Account" was synonymous with "log out".  Yes, I had deleted my iCloud account in my iPad email settings more than once yesterday and again one more time after I read your reply.  I then followed the instructions below to log off on my Windows PC.  I found these when I searched for how to log off of iCould:
    1- Go to www.iCloud.com
    2- Sign in with your current login info
    3- Click on your user name on top right corner
    4- Select account setting
    5- Select "Advanced."
    6- Click 2nd option, "Sign Out Of All Browsers."
    I also scanned settings for all the other apps on my iPad and changed a couple that still had my old sbcglobal email address. Later, I noticed that I was able to see my old previous iCloud emails in iCloud.com, and the couple of messages that I received from this Support Community site, but still no new emails.  Suddenly the emails started rolling in again this morning.  I have 7 new ones at the moment.  I sort of expected to get a backlog of emails from yesterday, but something tells me those were all lost as "undeliverable".  I don't know who or exactly what did the trick, but the issue seems to be fixed.  I'm using my new Apple ID, and I'm glad I don't have to get all new iCloud alias email addresses after all.

  • How will the Time Capsule support IPv6 and coop with the new emerging security threats that will emerge due to the new technical possibilities that IPv6 provide?

    How will the Time Capsule support IPv6 and coop with the new emerging security threats that will emerge due to the new technical possibilities that IPv6 provide?

    Cross your fingers and hope.
    Obviously if there is any big or known threat Apple will send out a firmware fix.
    But the TC is designed to be end user simple device. It has no firewall that is visible at any rate. I don't know that it truly doesn't have a firewall but it is not part of the end user controls.
    IMO if you have major security concerns that go beyond end device firewall, which is where Apple do put most of the security, since firewall in the router is plainly not a stop to anybody deliberately downloading an infected file or website, and most end users.. do not want a firewall that prevents them using the web like a business does, where only certain ports are allowed. Everything else tough luck.. you are not allowed to use it. Then TC is unsuitable for you anyway.. buy a proper firewall appliance.

  • Mitigation runs against role but not user with same role assignment

    Hello, I'm currently running Compliance Calibrator 4.0. I've created a Mitigation Control and assigned a number of Risks to the Mitigation Control.
    I've then assigned the Risks in that Mitigation Control to a specific role.
    When I run the SoD check, the role no longer shows any issues. This is good and expected.
    However, when I run the SoD against a user that has that role assigned the user is reported with issues when no SoD issues should be shown.
    Am I missing something? I don't believe I need to assign Mitigation Control to the user, because one day the risk might be valid to that user, but just not for the role I'm trying to mitigate against. Many thanks.

    Hi Dylan, the system is reacting correctly.
    When you mitigate a role, you mitigate the risk associated with the role and under 'Role Analysis' you will see that this role has been mitigated.
    However when u run a User analysis, the system will still identify him if there is a 'RISK' associated with the user and this is regardless of whether the associated Role is mitigated or not because what you want to know is the risk of the user and not what roles this user has.
    You will need to specifically mitigate the User in order for the mitigation control to show against the User in the report.
    This is the same Vice Versa. when you mitigate a User, it also does not mean that all the associated Roles that the user have are mitigated. The risk associated with the roles will still appear when you do 'Role Analysis'
    Cheers!

  • How groups are assigned in OBIEE 11g if a user is present in more security

    Suppose we have security provider1 & provider2 having the same user. If provider 1 is in top of list and it have group 1 assigned to the user1 , then how can i get group2 assigned to user1 in provider2?

    The problem was with user filter.

  • Unable to move ALL my apps from ITunes Library to my new phone

    I just restrored my 4s from an old backup. My Lib has 75 aps but the new phone only pickedup up 44. Aps Syn is enabled. Please help.

    Are all your apps compatible with the iPhone--are some iPad only apps?
    Have you tried resynching?
    Have all your apps been purchased with the same AppleID?

  • Role Privs to User with no privs???  How???

    When creating a role that is basically a group of ‘SELECT ON’ privs to tables that belong to different schema’s that one user does not currently have access to, and gets assigned this role, will he now be able to perform selects on the specified tables through the role or does he 1st need privs on the table then he can use the role that will be assigned to him.
    Example: user U1 does not privs on A.T1 and B.T1.
    Create role MYTEST
    Grant SELECT on A.T1
    Grant SELECT on B.T1
    Grant MYTEST to U1
    Will U1 now have the rights to view the data from A.T1 and B.T1?

    You have to create a role and grant the select privilleges to that role only from a user which has select privilleges on the specific tables and that to with admin option
    Meaning something like create the role from the system user and from the system user grant all the select on table privilleges and then finally from the system user grant the role to your user1 user. Now he will have the expected select on <table> privilleges
    Eg : sqlplus system/pwd
    create role my_role;
    grant select on a.t1 to my_role;
    grant select on b.t2 to my_role;
    grant my_role to user1;
    This would suffice
    Message was edited by:
    Shasi

  • Unable to edit MailBox folder & Rules of other users with PowerShell

    Hello,
    I'm trying to modify the rules of my users inbox folders and rules but I'm not able to do that even though I'm assigned the rights which were supposed to be enough. The account I'm running this command is a domain admin and pretty much has all the rights for
    the exchange server.
    Add-MailboxFolderPermission -Identity satan:\Inbox -User god -AccessRights Owner
    Add-MailboxPermission -Identity satan -User god -AccessRights FullAccess -InheritanceType All
    New-MailboxFolder -Parent Satan:\Inbox -Name Test
    New-Inboxrule -name "Test" -mailbox satan -sentTo "Angels" -MoveToFolder Test  -force
    And this is what I get:
    The specified mailbox "Satan" doesn't exist.
        + CategoryInfo          : NotSpecified: (:) [New-MailboxFolder], ManagementObjectNotFoundException
        + FullyQualifiedErrorId : [Server=XMAIL,RequestId=f20bwe154-31f1-4f2e-ad67-5d20eaf609197,TimeStamp=2015-04-21 2:39:12
        PM] [FailureCategory=Cmdlet-ManagementObjectNotFoundException] F132355E,Microsoft.Exchange.Management.StoreTasks.
      NewMailboxFolder

    mbaybarsk,
    New-MailboxFolder doesn’t have the capability of creating folders in users mailboxes.
    When administrator is logged in . It has the capability of creating a folder only in Administrator mailbox
    For more info see this link: 
    http://careexchange.in/quick-tip-new-mailboxfolder-exchange-2013/
    Cheers,
    Curt Winter
    Certified Microsoft Professional
    Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied. If you found my post helpful, please mark it as the answer.

  • If i plug my ipod into my new mac which doesnt have all the music that i previously put on my iPod, will i lose all that music if i sync with the new music on my itunes?

    my old computer crashed a while ago, before i was able to transfer my music to my new mac.....i have all the music on my ipod but im worried that ill lose all my music when i sync it with the itunes and new music. i know the purchased items will get transferred but im worried about losing all the other music?

    Follwo these instructions to not lose anything
    Syncing to a "New" Computer or replacing a "crashed" Hard Drive: Apple Support Communities

  • All sqls executed by an user with a timeframe with bind variables.

    10.2.0.4 Version.
    Is there a way to get list of all the sqls executed by an user between time t1 and t2 with bind variables along with the stats from v$sql.
    I am able to get binds from v$sql_bind_capture for an user but not able to restrict to the time frame I want.
    Thanks for help in advance.

    Enable 10046 trace (level=12) for the sessions in question.
    Make sure you have enough free space available as this could result in a huge file depending on session's activity.
    Asif Momen
    http://momendba.blogspot.com

  • Will my ipod lose all data if i sync it with my new laptop

    I just received a new laptop, and i was wondering if i sync my ipod to the laptop then will it lose all its data?

    Did you transfer all the data from the old laptop to the new one? If you did you should be fine. If you did not you can authorize it with iTunes wby using the same id that is currently on the iPod. You should get a message asking to sync after logging in on itunes on your laptop.
    Hope it works!
         BRB8910

  • I am unable to use the disk drive on my G4 with my new MacMini (late 2011)

    I have followed the directions RE: enabling sharing on both computers and the G4 shows up on the Mini, but the disk in the drive doesn't show up. I am trying to install some newly purchased software (Adobe Photoshop Elements 10) from the G4 drive to the Mini.

    Just for clarity ... are you trying to run some software from the G4 drive on the new mini? That won't work, since Lion no longer has Rosetta emulation, and doesn't run PowerPC code. Adobe Photoshop elements 10 will only run on your new mini.
    One way to share your G4 hard drive with your new mini is by putting the G4 into target disk mode. Reboot holding the T key down, and you'll see a firewire symbol moving about the screen. Then connect a firewire cable between the two systems. You may need a firewire 400 to 800 adapter. The one I used when coverting my G4 mini is http://www.amazon.com/gp/product/B002JH3TW8/ref=ox_sc_act_title_1?ie=UTF8&m=ATVP DKIKX0DER

  • Ticketadmin and Custom Security Role

    A friendly hello to all readers!
    I'm facing the following problem:
    We want our customer to enter his tickets into the WebCRM. For this task I've created two new Security Roles ('GP User' and 'GP Key User'). The 'GP User' Role is working fine. Members of this Role just can enter tickets and watch the status.
    Members of the Role 'GP Key User' are also part of the Role 'Licensed User'. This users are only allowed to work on the tickets and the knowledge-base in the administration panel.
    The problem now is, that this special Users can't change the status of an ticket and are not allowed to assign the ticket to another person. (But in batch operation they can!).
    What can I do to enable the full functionality on admin/support/ticketadmin.aspx?
    Hints:
    - The user of role 'Key User' are not assigned to the internal account.
    - Version: 2007.0.631.11
    Thanks!

    If you go to Admin > Definitions > Security Roles you can select a role to see what that role has access too. This role is in addition to the licensed user role and determines what will show up on the admin menu and what pages they can access directly.
    You could either screenshot the Support Admin's list of permissions or run it directly on the sql db.
    Even if a menu item is not listed, it would still be possible for the user to type in the direct url of a specific page for any pages they have access to. For example the permission for Web Page admin/support will allow that role to access any page in the support directory. To restrict, you might just give access to admin/support/tickets.aspx or other aspx pages directly.
    Before praxis was acquired by SAP we used to have a custom theme strictly for support that had links to 4 ticket related functions only. Might reduce some confusion.
    James

Maybe you are looking for