Security Group Tips

Refer to the following tips when creating and editing security groups.

Combining Security Groups

• When overlaying security groups, the most restrictive permissions for each module are applied.
• Users cannot be assigned to more than one security group with the same module permissioned and object level permissions enabled on that module.
• Use the Ignore option when the permissions for a module are defined in an opposing security group. Not checking Ignore will result in no permissions for that module.

NOTE: For example, Group A has the Attachments module permissioned with object level permissions enabled, while Group B has the Attachments module permissioned without object level permissions enabled. Users cannot be added to both groups. If neither group has object level permissions enabled for the Attachments module, the user can be added to both groups.

Data Permissions

• Permissions for specific data types override top level Data permissions. If top level Data permissions is not enabled, only the specific data types permissioned will be available.
• When defining permissions for specific data types across multiple security groups, you must check the Ignore option in the opposing security group for the specific data type or for Data. Otherwise the result will be no permissions (most restrictive).
• If top level Data permissions and object level permissions are both enabled, all data records will be available for all data types without object level permissions enabled.

NOTE: For example, if top level Data permissions is enabled and object level permissions is enabled to limit to a single location, all computer records across all locations will be available. To only make data records available in a single location, disable top level Data permissions and permission the data types you want to be available.

Object Level Permissions

• With object level permissions enabled, creating new objects (attachments, waves, tasks, and data records) adds them to the permissioned list.

Permission Names by Module

The same permission appears under different labels depending on the module.

Current Limitations

• Only one SSO group can be mapped to a security group. Mapping multiple SSO groups to a single security group is not supported.