My Settings access for Request access level end users - restrict ability to update fields

[GregoryBr]

We have a use case where an end user has read only access (can enter comments in Update stream). The user can only see Issues where they are the Primary Contact. I'm doing some testing and finding a few potential access issues. The user is able to click their avatar and select My Settings. The users is able to edit their Personal Info and Preferences. This includes the When I log in, show: drop down. The user could add My Work and Projects tabs. We would prefer the end users not be able to update any of these fields. Has anyone found a way to lock down My Settings? Greg Brisendine MRC Global

[EXP_-_DustinMa]

Hey Greg, You can create or edit a layout template, remove the tabs you don't want them to have access to, then assign the template to them. Once you've done that, they can go in and try and add those tabs, but they won't be able to, see here for example: I hope this helps! Thanks, Dustin Martin Tier 2 Assigned Support Engineer Workfront

[GregoryBr]

Thanks Dustin. The bigger issue is the editing of name, title, address, city, etc. We're updating those fields via the .api from AD and would rather the end user not change those. Per Workfront support it doesn't appear to be possible to limit the user access to those fields. Greg Brisendine MRC Global

[EXP_-_DustinMa]

Hey Greg, You're right, those fields will unfortunately remain editable by the user. Most of my clients with SSO set up tend to use auto provisioning, which will also sync the user's information with AD/LDAP. Though, we'll be moving towards SAML 2.0 only in the future, so if you use the actual AD or LDAP SSO config currently, you might want to look into moving towards SAML 2.0 with say ADFS or another provider soon. Feel free to reach out to me if you run into any other issues, always happy to help. Thanks! Dustin Martin Tier 2 Assigned Support Engineer Workfront