Sensei Blog & News

The blog about Microsoft productivity, project and portfolio management and business insights solutions.

Subscribe

Using Protected Baselines

Background Information

I received an interesting question from one of our new clients this past week, and I thought you might be interested in the answer.  The client wanted to know how to prevent project managers from saving a baseline in their projects, and to restrict all baseline operations to only those who are staff in the Project Management Office (PMO). The answer to this question involves two steps:

  1. Create a custom security group for staff in the PMO that will allow them to save a baseline in every enterprise project.
  2. Change the default settings in the Project Managers security group to prevent them from saving a Protected Baseline.

Before I demonstrate how to perform these steps, let me explain how the Microsoft PPM solution (Project Online and Project Server) controls who can save a baseline in enterprise projects. There are two types of baselines in the system: Protected Baselines and Unprotected Baselines. The Microsoft PPM solution designates Baselines 0-5 as Protected Baselines and Baselines 6-10 as Unprotected Baselines.

Using security permissions, it is possible to “lock down” both Protected and Unprotected Baselines to prevent project managers from saving a baseline in their projects. Some organizations choose to allow their project managers to use Baselines 6-10 for personal use, while other organizations will not allow their project managers to save a baseline in any of the Baseline fields.

Creating a Custom Security Group for the PMO

To create a custom security group that will allow staff in the PMO to save a Protected Baseline in all enterprise projects, the Microsoft PPM application administrator should complete the following steps:

  1. Log into Project Web App (PWA) with administrator permissions.
  2. Click the Settings menu button (it looks like a gear wheel) in the upper right corner of the Home page and select the PWA Settings item on the menu.
  3. In the Security section of the PWA Settings page, click the Manage Groups link, as shown in Figure 1.

Figure 1: Manage Groups link

4. At the top of the Manage Groups page, click the New Group button as shown in Figure 2.

Figure 2: Manage Groups page

5. On the Add or Edit Group page, enter a name for the new security group in the Name field, enter a description in the Description field, and then optionally enter an Active Directory group name in the Active Directory Group field (only if you want to use AD sync to manage the members of this group).

6. In the Users section of the page, add the names of the members of this new security group to the Selected Users list on the right side of the page, as shown in Figure 3.

Figure 3: Add users to the new group

7. In the Categories section of the page, add the My Organization category to the Selected Categories list on the right side of the page, as shown in Figure 4. Adding this category to the new group will give staff in the PMO access to every enterprise project.

Figure 4: Select the My Organization category

8. With the My Organization category still selected in the Selected Categories list, scroll to the bottom of the Permissions for My Organization data grid.

9. At the bottom of the data grid, click the Set permissions with Template pick list and select the Project Manager item on the list, as shown in Figure 5.

Figure 5: Apply the Project Manager template

10. Click the Apply button to the right of the Set permissions with Template pick list.

Project Web App will apply the default permissions using the Project Manager template, and will display these permissions in the Permissions for My Organization data grid. Figure 6 shows the default permissions in the Projects section of the data grid. Notice that the Save Protected Baseline permission is set to Allowed (the Allow checkbox is selected for this permission).

Figure 6: Save Protected Baseline set to Allowed

11. Scroll down the page to the bottom of the Global Permissions data grid.

12. At the bottom of the Global Permissions data grid, click the Set permissions with Template pick list and select the Project Manager item on the list.

13. Click the Apply button to the right of the Set permissions with Template pick list as shown in Figure 7.

Figure 7: Apply the Project Manager template

Project Web App will apply the default global permissions using the Project Manager template and will display these permissions in the Global Permissions data grid.

Figure 8 shows the default permissions in the Project section of the data grid. Notice that the Save Unprotected Baseline permission is set to Allowed (the Allow checkbox is selected for this permission).

Figure 8: Save Protected Baseline set to Allowed

14. Click the Save button to save the new custom security group.

Change the Settings for the Project Managers Security Group

Warning: The content in this topical section of this blog post assumes that you have not changed the default permissions in the Project Managers security group.

After creating the new custom security group that will allow staff in the PMO to work with baselines in all enterprise projects, you must also change the default permissions for the Project Managers security group to prevent them from saving a Protected Baseline. To change these settings, complete the following steps:

  1. In the Group Name column of the Manage Groups page in PWA, click the link for the Project Managers security group to open it for editing, as shown in Figure 9.

Figure 9: Edit the Project Managers security group

2. In the Categories section of the page, select the My Projects category in the Selected Categories list, as shown in Figure 10.

Figure 10: Select the My Projects category

3. With the My Projects category still selected in the Selected Categories list, deselect the Allow checkbox for the Save Protected Baseline permission in the Permissions for My Projects data grid, as shown in Figure 11.

Figure 11: Deselect the Save Protected Baseline permission

Important Note: When you deselect the Allow checkbox for the Save Protected Baseline permission, you are setting this permission to the Not Allowed state. The Not Allowed state means that both the Allow and Deny checkboxes are deselected, which will prevent your project managers from saving a Protected Baseline in all their enterprise projects.

4. If you want to prevent your project managers from saving an Unprotected Baseline as well, scroll to the Project section of the Global Permissions

5. Deselect the Allow checkbox for the Save Unprotected Baseline permission, as shown in Figure 12.

Figure 12: Deselect the Save Unprotected Baseline permission

6. Click the Save button to save the changes to the Project Managers security group.

Saving a Baseline for an Enterprise Project

After setting up security permissions for Protected Baselines and optionally for Unprotected Baselines, your PPM system is now ready to begin enforcing your organization’s baselining policies.  When staff members from the PMO open and check out any enterprise project, the system will allow them to save, update, and even delete baselines in any of the eleven sets of Baseline fields.

When project managers open and check out an enterprise project, however, the system will prevent them from making any changes to Protected Baselines, and optionally to Unprotected Baselines as well. For example, when your project managers attempt to save a baseline, they will see a warning dialog like the ones shown in Figures 13 and 14.

Figure 13: Unable to save a Protected Baseline

Figure 14: Unable to Save an Unprotected Baseline

 

About Dale Howard, Director of Education, Sensei Project Solutions
Dale Howard is a seasoned training professional who is approaching 30 years of technical training experience. He has taught students how to effectively use every version of Microsoft Project beginning with version 4.0 for Windows 95, and every version of the Microsoft EPM tool beginning with Project Central in the year 2000. Dale possesses the coveted Project MVP title and is one of only 64 Project MVPs in the entire world. He is the co-author of 20 books on Microsoft Project and Project Server. Dale is known for high-energy, highly interactive style of presenting and teaching. He was voted the “Best Presenter” by conference participants at the Project Conference in 2012.

 

 

 

 

 

 

 

About Sensei Project Solutions

Sensei Project Solutions, a Finalist for the 2015 Microsoft Project and Portfolio Management (PPM) Partner of the Year, focuses on bringing Instant Productivity to your team. Our mission is to help individuals and organizations be more productive so that they can achieve their greatest potential. As a Gold certified Microsoft Partner and Registered Education Provider (R.E.P.) with the Project Management Institute (PMI®), Sensei offers a complete set of services and products for a successful Microsoft PPM deployment. Our guiding principles for Proactive PPM follow best practices and industry standards aligned with the Project Management Institute (PMI) and Gartner, enabling organizations to manage resource demand, obtain business intelligence that facilitates better decision making, increase business effectiveness by easily connecting people, and become self-sufficient with PPM processes and solutions. In short, Sensei helps organizations achieve Instant Productivity.

Stay up to date with insights from the Sensei Blog

  • This field is for validation purposes and should be left unchanged.