I received an interesting question from one of our new clients this past week, and I thought you might be interested in the answer. The client wanted to know how to prevent project managers from saving a baseline in their projects, and to restrict all baseline operations to only those who are staff in the Project Management Office (PMO). The answer to this question involves two steps:
Before I demonstrate how to perform these steps, let me explain how the Microsoft PPM solution (Project Online and Project Server) controls who can save a baseline in enterprise projects. There are two types of baselines in the system: Protected Baselines and Unprotected Baselines. The Microsoft PPM solution designates Baselines 0-5 as Protected Baselines and Baselines 6-10 as Unprotected Baselines.
Using security permissions, it is possible to “lock down” both Protected and Unprotected Baselines to prevent project managers from saving a baseline in their projects. Some organizations choose to allow their project managers to use Baselines 6-10 for personal use, while other organizations will not allow their project managers to save a baseline in any of the Baseline fields.
To create a custom security group that will allow staff in the PMO to save a Protected Baseline in all enterprise projects, the Microsoft PPM application administrator should complete the following steps:
Figure 1: Manage Groups link
4. At the top of the Manage Groups page, click the New Group button as shown in Figure 2.
Figure 2: Manage Groups page
5. On the Add or Edit Group page, enter a name for the new security group in the Name field, enter a description in the Description field, and then optionally enter an Active Directory group name in the Active Directory Group field (only if you want to use AD sync to manage the members of this group).
6. In the Users section of the page, add the names of the members of this new security group to the Selected Users list on the right side of the page, as shown in Figure 3.
Figure 3: Add users to the new group
7. In the Categories section of the page, add the My Organization category to the Selected Categories list on the right side of the page, as shown in Figure 4. Adding this category to the new group will give staff in the PMO access to every enterprise project.
Figure 4: Select the My Organization category
8. With the My Organization category still selected in the Selected Categories list, scroll to the bottom of the Permissions for My Organization data grid.
9. At the bottom of the data grid, click the Set permissions with Template pick list and select the Project Manager item on the list, as shown in Figure 5.
Figure 5: Apply the Project Manager template
10. Click the Apply button to the right of the Set permissions with Template pick list.
Project Web App will apply the default permissions using the Project Manager template, and will display these permissions in the Permissions for My Organization data grid. Figure 6 shows the default permissions in the Projects section of the data grid. Notice that the Save Protected Baseline permission is set to Allowed (the Allow checkbox is selected for this permission).
Figure 6: Save Protected Baseline set to Allowed
11. Scroll down the page to the bottom of the Global Permissions data grid.
12. At the bottom of the Global Permissions data grid, click the Set permissions with Template pick list and select the Project Manager item on the list.
13. Click the Apply button to the right of the Set permissions with Template pick list as shown in Figure 7.
Figure 7: Apply the Project Manager template
Project Web App will apply the default global permissions using the Project Manager template and will display these permissions in the Global Permissions data grid.
Figure 8 shows the default permissions in the Project section of the data grid. Notice that the Save Unprotected Baseline permission is set to Allowed (the Allow checkbox is selected for this permission).
Figure 8: Save Protected Baseline set to Allowed
14. Click the Save button to save the new custom security group.
Warning: The content in this topical section of this blog post assumes that you have not changed the default permissions in the Project Managers security group.
After creating the new custom security group that will allow staff in the PMO to work with baselines in all enterprise projects, you must also change the default permissions for the Project Managers security group to prevent them from saving a Protected Baseline. To change these settings, complete the following steps:
Figure 9: Edit the Project Managers security group
2. In the Categories section of the page, select the My Projects category in the Selected Categories list, as shown in Figure 10.
Figure 10: Select the My Projects category
3. With the My Projects category still selected in the Selected Categories list, deselect the Allow checkbox for the Save Protected Baseline permission in the Permissions for My Projects data grid, as shown in Figure 11.
Figure 11: Deselect the Save Protected Baseline permission
Important Note: When you deselect the Allow checkbox for the Save Protected Baseline permission, you are setting this permission to the Not Allowed state. The Not Allowed state means that both the Allow and Deny checkboxes are deselected, which will prevent your project managers from saving a Protected Baseline in all their enterprise projects.
4. If you want to prevent your project managers from saving an Unprotected Baseline as well, scroll to the Project section of the Global Permissions
5. Deselect the Allow checkbox for the Save Unprotected Baseline permission, as shown in Figure 12.
Figure 12: Deselect the Save Unprotected Baseline permission
6. Click the Save button to save the changes to the Project Managers security group.
After setting up security permissions for Protected Baselines and optionally for Unprotected Baselines, your PPM system is now ready to begin enforcing your organization’s baselining policies. When staff members from the PMO open and check out any enterprise project, the system will allow them to save, update, and even delete baselines in any of the eleven sets of Baseline fields.
When project managers open and check out an enterprise project, however, the system will prevent them from making any changes to Protected Baselines, and optionally to Unprotected Baselines as well. For example, when your project managers attempt to save a baseline, they will see a warning dialog like the ones shown in Figures 13 and 14.
Figure 13: Unable to save a Protected Baseline
Figure 14: Unable to Save an Unprotected Baseline
