Is there a way to set up default company access to specific projects outside of templates specific to each company or portfolio/program sharing?

[JannahVa]

We manage projects across many different clients and are trying to figure out the most efficient way to keep project association clean internally as well as give our external primary contacts view access to those projects associated with their 'company' in Workfront.

• We use only a few project templates across all of our clients so I don't think we'd be able to limit the template/project sharing settings appropriately since they're used across multiple 'companies'. Creating templates specific to each 'company' would not be scalable.
• Currently, we have a program setup for each client and I know we could set view access at that level, which would be inherited down, but we're trying to limit the amount of duplicate information in our system. With this setup, the 'company' would match the 'program' and we have users entering the same data in two different fields.
  • The dashboard we have setup for customers uses the $$USER.companyID wildcard to view their projects, so I think entering the 'company' on each project is necessary.

Is there a way to associate a 'company' with a 'program' or a different way to set up a default view permissions to projects associated with a specific 'company'? Or would there be a different way to setup their dashboard reports using a different wildcard that could look at the 'program'?

Any suggestions are appreciated, I have been going around and around and might be missing something higher because I'm so deep in the weeds!

[BenettaPe]

Jannah,

You can create different companies and then give the specific company access to specific projects.

[JannahVa]

Thanks Benetta, but we're really hoping that access can be setup automatically instead of having to manually assign each one.

[NRYNR]

Hi Jannah, I suggest you use Groups for controlling security on portfolios, programs, templates, projects, queues, etc. instead of Company. People can be part of multiple groups, and as the instance expands, they will. Controlling security through a combination of methods for us at Truist has proven unmanageable. We’ve tried to use teams, job roles and companies in the past and they all failed and were more headache than they were worth. Thanks, Narayan

[JannahVa]

Hi Narayan,

Thanks for the response! Even with groups, I think I'll still run into the same issues I'm trying to figure out now. The main thing we're trying to figure out is to avoid as much manual setup as possible. I'd love to figure out a way to automatically have the projects associated with a company (or group) shared with all of those users and then also be able to pull reports for their dashboards based on a user wildcard, rather than having to set up a dashboard for every client.

I know you can setup project sharing form the template level, but that's too broad because the templates are shared across multiple clients so I'd have to share with all. I like the portfolio/program sharing because any projects added will inherit the sharing permissions, but I couldn't figure out a way to pull the reports based on a user wildcard looking at the program. It feels redundant because we'd essentially have programs aligning with our companies/groups but we may just have to do that to get all the visibility needed...

[NRYNR]

Hi Jannah, You’re asking the right questions. Luckily, I’ve spent that better part of a decade in the trenches making all the same mistakes so you don’t have to. I’d avoid “Project Sharing” on templates because as you’ve learned, security is too granular and can’t be controlled broadly. What you need to do is ensure that your configuration includes a Portfolio and Program so you can set them as defaults in the template. This ensures that when users create projects using the template, the project is placed into the right location in the system. Be sure you share (View Rights) the template, portfolio, and program with the group to make sure that users can actually use the template and place a project in the program. Sharing your dashboards with the group will complete the security of the configuration. Then all you need to do is add the group to the user profile and you can be comfortable knowing they can use templates, save projects in the portfolio, and access all dashboards/reports needed to view the work. A single dashboard shared with all groups would ensure each is sharing a single dashboard, but the data they see will be limited to what they’re allowed to see based on the group settings. In the end, you’ll have a configuration that is sustainable. Add users to the group and they get it all. Remove them from the group, and they lose it all (unless they were explicitly shared/assigned). This approach combined with WFPro Package Manifest<> is the only reason we can manage our instance with just two admins at Truist. Thanks, Narayan

[JannahVa]

Thank you Narayan! I was making it too complicated and trying to filter their report on top of permissions, but setting up their permissions accurately at the start will take care of it. Thank you for the recommendations, they were just what I needed and I'm looking into the package manifest you linked! Thank you!!