project server 2010: setting permissions for CEO, project manager, and project director RRS feed

  • Question

  • Hi,

    I am trying to implement an organizational structure on EPM. For that, I need to define 4 types of people with the description of each as shown below:

    1- CEO: Has access to all projects. Mainly interested in reports but may access any project plan whenever he wants with full control.

    2- Project Director: Has access to all projects that he is the project director on. Denied access to projects he is not the project director on. Has full control on these projects and may be interested to see some reports.

    3- Project Manager: Has access to all projects that he is the project manager on. Denied access to projects he is not the project manager on. Has full control on these projects and approves/rejects the timesheets of the resources working on his projects.

    4- Team Members: Resources that are assigned to tasks and submit timesheets to the project manager. No access to the project but just access to the PWA Timesheet.

    How can I implement this? I believe the team members are the regular team members and the project manager is the owner of the project. But how can I define the project director and set project directors to specific projects? And how can I define the CEO and provide him with the right combination of permissions to be able to perform his job?

    Any help much appreciated.


    Monday, January 30, 2012 8:40 AM

All replies

  • Moreover, how can I manage the default user groups? For example, lets say I need to set all project directors as portfolio managers. If I add these users to the portfolio managers security group, how does EPM know what projects are these project directors related to?
    Monday, January 30, 2012 9:29 AM
  • Hi George,

    I am trying to figure out the same issue. Was wondering if you ever found the proper settings?



    Tuesday, May 22, 2012 6:19 PM
  • Hi George,

    I think you need to further expand on your definitions - also, it is really difficult to fully cover all the permissions you require, so I'll concentrate on the important ones.

    For 1. do you mean the CEO has write access to all projects?  If so (really?? - what do you employ project managers for) then I would make a copy of the Executives group, and then change the permissions for the My Organisation category associated with the group and add the open, save and publish permissions.

    2. How do you define how he is the project director - categories are dynamic only via the RBS or by adding a resource to a project.   You could fudge this by creating a a new group called Project Director, and changing the permissions to the My Projects category for that group, again so that they have open, save and publish permissions.  Project Directors would need to be added to the project team.  An alternative is to manually add/remove the projects from individual project director categories (one per project director) - this would be time consuming.

    3. This is the default - be very wary of using the term DENY when talking about permissions.

    4. I would set access to the team member group to the Project Centre to neither allow nor deny, thereby defining a soft deny.

    For further information have a look at

    Ben Howard [MVP] blog | web

    Tuesday, May 22, 2012 7:36 PM
  • Hi Ben,

    I had a question for you in regards to point 3 of project managers. In our current system, members that are placed in the "project manager" security group can view ALL projects in project center even the ones they are not assigned to or managing. These members also have "read only" access to other MS project plans. I'm trying to figure out how to change the settings of the project manager group so these members can only see projects they are managing in project center view. Can you help me with this?

    Much appreciated!


    Tuesday, May 22, 2012 9:27 PM
  • Phiilip, it it likely that you have changed the default permissions, and that you have associated the category My Organisation with the Project Manager group - remove this association and all should be well.

    Ben Howard [MVP] blog | web

    • Proposed as answer by Phillip999 Tuesday, June 12, 2012 5:40 PM
    Wednesday, May 23, 2012 5:54 PM