QQ: How Well-Insulated Is Your Instance?

I'm a novice at this, but it seems like we were able to isolate folks by using Companies, Layout Templates, and very specific sharing.

The only isolation that I don't think WF allows is the People, as in the "directory"...I can disable the People tab as needed, but determined people can still Search for users.

I'm curious if I'm missing the obvious, so this thread is worth a watch!

The group admin access has it's limitations. For example, our group admin could not see any additional access levels despite they were 'below' her access level. It led for some challenges. Eventually I just made another admin but it's not what we wanted.

Overall, we were able to restrict users from adding the other users by using Company segregation. We used the groups/teams settings on a template sharing/project sharing settings to keep other users from seeing what they shouldn't.

However like Kevin indicated - it doesnt stop the 'People' area from being populated.

We are currently adding in another area into our instance with WF. Not thrilled as it would be ideal for them to have their own instance. So I'll be sure I'll update here when we run into issues.

Hi - we have 15 totally different business units in our global instance. Now some of them do work together or there is a shared services like Studio Rx where everyone goes to, but otherwise they are separate entities. I highly recommend using Groups to do the separating. Because of our org structure, company didn't work as people might report into someone in a different business unit as you move up the scale and Workfront doesn't allow that.

Groups gives you the ability to have group admins (which kind of suck now but I know product is working on it) as well as gives the ability for custom statuses, schedules, and custom forms (since those are tied to groups).

It isn't 100% isolated because we have one team that uses agile so we had to add a task status called Not Needed/Cancelled to be system-wide for them to do that, (which we have a governance council for). The groups also share job roles, companies (which are clients for us), and they do see the whole list of team names in drop down. But really, it is pretty isolated. We've been doing it for 6 years and haven't had any that have caused people to get their own instance.

Things that won't be isolated (i.e. everyone of the appropriate level will see) include:

• Job Roles
• People
• Companies
• Teams

Using groups, you can isolate

• Portfolios and projects within them
• Custom forms
• Proof approval Workflows (although not really using groups for this one)

You can't really isolate the following, but usually only Admin go poking around these so it's kinda okay

• Milestone paths
• Approval paths