Customize Access Using Permission Set Groups

Permissions define what users can do with the data that they have access to in Salesforce. For this purpose, TaskRay provides a set of packaged permission sets designed to grant users access to app functions and data. While the packaged permission sets apply to most use cases, it is possible to take the custom approach for advanced user access requirements. 

In this article, we provide an overview of how to best approach custom access requirements for TaskRay. Since packaged TaskRay permission sets cannot be edited, it is recommended to utilize Permission Set Groups for this purpose. This is an optional configuration that only applies to advanced use cases.

About Permission Set Groups

Permission Set Groups allow bundling permission sets, making it easy to manage user access based on job personas or roles within an organization. Permission Set Groups also incorporate muting permission sets, which are designed to restrict access where necessary. 

TaskRay Application

For TaskRay, Permission Set Groups can be configured to include all applicable TaskRay permission sets to define the necessary level of access for a user group. Then, muting permissions can be added to lock down access as needed in TaskRay for that user group.

When structuring a Permission Set Group for TaskRay, it is important to include a base-level packaged TaskRay permission set (e.g. TaskRay - Standard Access) in the configuration. This will ensure uninterrupted user access whenever TaskRay updates take place and new functionality is released. We cover this consideration in greater depth in the TaskRay Updates & Customized Access section.

Taking that into account, below are some examples of Permission Set Groups for TaskRay.

Example 1: Customized Access for Standard Users

For this example, we'll assume that it is necessary to restrict TaskRay standard user access, such as to lock down the ability to create new projects and to restrict the ability to edit Estimated Time on tasks.

The Permission Set Group should be constructed as follows:

• Permission Sets in Group
  • TaskRay - Standard Access (for base-level access)
• Muting Permission Set in Group
  • TaskRay Project: muted Create permission (to restrict the ability to create Projects)
  • TaskRay Task: muted Edit Access to Estimated Time (hrs) field (to restrict the ability to edit Estimated Time on Tasks)

With this configuration, standard users will still be able to access all of the main TaskRay app functionality, but they will not be able to create new projects or edit the estimated time on tasks.

Example 2: Bundled Permissions for Project Managers

For this example, we'll assume that there are no access restrictions needed for project managers. That said, TaskRay offers a supplemental permission set for project managers, designed to open up elevated access to certain app functions.

The Permission Set Group should be constructed as follows:

• Permission Sets in Group
  • TaskRay - Standard Access (for base-level access)
  • TaskRay - Project Manager Access (for elevated access)

This example demonstrates the ability to bundle permission sets, which helps streamline permission set assignments for users. It is important to note that the TaskRay - Standard Access permission set is included in the group configuration. This is a required component of the group configuration, as it provides base-level access to the TaskRay app. TaskRay - Project Manager Access is a supplemental permission set that does not grant base-level access to the app. It contains only the elevated permissions and it must be assigned in addition to the Standard Access permission set.

TaskRay Updates & Customized Access

Whenever TaskRay product releases take place and new functionality is introduced, packaged TaskRay permission sets are automatically updated to reflect the changes and new permissions. By including one of the packaged base-level permission sets (e.g. TaskRay - Standard Access) in the Permission Set Group configuration, the group will always stay up to date whenever new functionality is released. 

Permission Set Group Configuration [Admin]

Create Permission Set Group

1. From Setup, navigate to Administration | Users | Permission Set Groups.
2. Click on New Permission Set Group.
3. In the modal that appears, enter the Permission Set Group Label (e.g. "TaskRay User Permissions")
4. Optionally, enter a Description.
5. Click Save.

Add Permission Set(s) to the Group

The first key configuration step is to add permission sets to the group. The goal of this step is to define the level of access that users who are assigned this Permission Set Group will have for TaskRay.

1. From the Permission Set Group detail screen, click on Permission Sets in Group.
2. On the following page, click on Add Permission Set.
3. From the list, select all applicable permission sets to be included in the group. 
   • For standard TaskRay users, select the TaskRay - Standard Access permission set.
   • For read-only TaskRay users, select the TaskRay - Read Only Access permission set.
   • Optionally, select any other relevant permission sets (e.g. additive TaskRay permission sets). These should be added in addition to the main permission set (e.g. TaskRay - Standard Access).
4. Click Add.
5. On the following page, click Done.

When you are done, return to the Permission Set Group detail screen.

Add Muting Permission Set to the Group

Next, you will need to create and configure the muting permission set for the group.

1. From the Permission Set Group detail screen, click on Muting Permission Set in Group.
2. On the following page, click on New.
3. The following screen will provide a default Label for the new muting permission set. You can leave the defaults as-is or optionally update them. Then click Save.
4. On the following page, click on the newly created Muting Permission Set.
5. On the Muting Permission Set detail page, click on Object Settings.
6. This will list all available objects for which permissions can be muted. From here, click on any of the TaskRay objects (e.g. TaskRay Project, TaskRay Task) where you need to restrict access.
7. On the object settings screen, click Edit.
   
8. Using the checkboxes, select the specific permissions and fields that need to be restricted.
   • Under Object Permissions, you can mute object-level functions, such as Create.
   • Under Field Permissions, select Read Access Muted for the fields that you don't want users to see.
   • Under Field Permissions, select Edit Access Muted for the fields that you don't want users to edit.
9. When you are done, click Save.

Repeat the steps for other objects and fields as necessary. When you are ready, return to the Permission Set Group detail screen.

Assign Permission Set Group to Users

After you are done with all Permission Set Group configurations, the next step is to assign it to applicable users.

1. From the Permission Set Group detail screen, click on Manage Assignments.
2. On the following screen, click on Add Assignment.
3. From the list, use the checkboxes to select users and then click Next.
   
4. On the following screen, click Assign.
5. Click Done.