How to manage existing the access teams when Access template rights are changed in Microsoft Dynamics CRM

It’s been more than 3 years that access teams have been introduced and perhaps every project I visit, I find the use of access teams. However there are still couple of nuances in access teams which most of the teams find it difficult to manage.

The first of them being the migrating the access team templates across environments. Access team templates are not solution aware. For this I have created a utility in codeplex which might help you.

http://accessteamsmigrator.codeplex.com/

The other perennial question that I keep on getting here is that what will happen to the existing access team rights if I change the access templates rights. I am going to discuss in detail what exactly happens to the existing access teams when the access template rights are changed.

For this let me take the opportunity entity and create a template for Opportunity.

I created an Opportunity Team Template with Access Rights – Append, AppendTo, Read and Write.

The next step is to insert the access template grid in the opportunity form. I will not waste more time in this no-brainer stuffs. So let’ s assume that everything is set-up and I have added a member to the access team sub-grid.

When a member is added to the access team, a record actually gets created in the PrincipalObjectAccess table in the back-end with the following details.

• PrincipalId – The Guid of the access team. The team name is in the following format  <record id> + <access template id>
• ObjectId – The guid of the opportunity record
• AccessRightsMask – Sum of the access rights provided in the template.

In case you want to know more details about the above stuffs, you may please explore my another blog post here – https://debajmecrm.com/crm-2013-access-teams-demysitified/

Screenshot of the team from advanced find. A very important point here is it is a system managed access team. It is not a user created access team. I will come back to this.

I have developed a small console here to actually query this principal object record. As a filter I have passed on the guid of the above team in the filter to fetch the specific record from POA for the demo.

And following is the result from the Quick watch view of Visual Studio.

As you can see, accessrightsmask is 23. It’s the sum of the access provided to the template earlier (Append (4) + Append To (16) + Read (1) + Write (2))

Now the fun part. I go ahead and change the access rights of the template. Additionally I give Share access.

I go ahead and add another member in the same opportunity record.

The new member gets added to the access team which is expected. But if I query for the access rights mask value of Principal Object Record, it is still the same.

So I can see, the new access right are not reflected in the existing access teams. For a solution I go ahead and delete all the members from the Opportunity team Sub-grid in the opportunity form. Now if I come to advanced find, the team is still there. However If I open the team, the team members has been deleted. So remember here system managed access teams are not automatically dissolved when all the team members are deleted.

So its pretty clear that removing and adding the team members won’t work. So now what?

There are couple of ways you can make the changes reflect.

1. Update the access rights mask through SQL Update. This would be a very simple query. The access rights would be the sum of all the individual access rights. You can get the access rights value from this link.

https://msdn.microsoft.com/en-in/library/microsoft.crm.sdk.messages.accessrights.aspx

Off-course you are  limited to On-premise and also this method is unsupported.

2. The other way can be updating would be to create a new template and add it as sub-grid in the new opportunity form and remove the old access team sub-grid. Then write a console batch to move members from the old access team to the new access team for all the opportunity records.

 

Hope this helps!