Tip #753: CRM Portal Security

Protect your pinIn this video, we look at the different Authentication & Authorization options for Dynamics CRM Portal capabilities. We walk through an overview of the elements, and then explore how to access and change them.

YouTube player

Give us your feedback, all of it: good, bad, and ugly, I’m sure we can take it. Suggest new topics either in comments or by sending your ideas to jar@crmtipoftheday.com.

Don’t forget to subscribe to http://youtube.com/crmtipoftheday.

Tip #752: Hidden subjects polluting the UI

Hidden pandaWe’ve been hopelessly late with our daily tips this week and for a good reason – CRMUG Summit in Tampa, Florida. CRM Medic booth is one of my favorite parts of the summit; whenever one feels like dealing with another puzzle, just don a white coat and listen.

Ed G complained that his Subject tree is polluted in the UI with some mysterious entries he cannot get rid of. A bit of collaborative brainstorming and XrmToolbox magic later, and here is the summary.

For a long time Subject had a enigmatic featuremask attribute that is described in MSDN as “Information that specifies when the subject will be displayed in lists of subjects”. Experience shows that it’s been around for a long time and setting the value to anything but 1 would hide the subject from UI. Why would anyone want to do that? Presumably to preserve data integrity during the import process (of cases or products) but without introducing the old or obsolete subjects into the tree.

It was all going well until CRM 2016 changed the pseudo-lookup control used for the subject. Now it’s some convoluted dropdown tree concoction. That does not honor featuremask setting and shows all subjects including hidden ones.

Proof of concept is easy:
Bad subject

  1. Import rogue subjects using Data Import
  2. Verify that they are hidden in Settings > Service Management > Subjects
  3. Open a case form and see the ghost

If you want to get rid of these, I don’t see a straightforward fix that does not involve writing code that would iterate over the subject tree and update the featuremask attribute to 1. Since subject does not appear in the advanced find, it’s not possible to modify values by export-modify-import process.

Tip #751: When only some views fail

Symptom

Square wheel failUsers can freely access entity records in some views but not the others – instead they receive the following error:

You do not have permission to access these records. Contact your Microsoft Dynamics CRM administrator.

Solution

Check that the views that generate “access denied” error do not include fields from the parent entity users do not have read permissions for. For example, if users have read permissions for Jobs but not the linked (parent) Client then the presence of any of the Client’s fields in a view will generate the error above. Note: it’s OK to include the lookup field itself – in our case it will show client’s display name.

Tip #750: Better diagnostics for CRM for Outlook

Ultimate diagnostics toolCRM for Outlook is one of the main components driving the adoption of Microsoft Dynamics CRM365. But it could be temperamental at times. SaRA, Office 365 Support and Recovery Assistant, that we mentioned previously, has been greatly enhanced and now includes the following features:

  • Verifying CRM for Outlook is the same major version as your CRM Online instance
  • Running the CRM Configuration Wizard with a custom configuration file
  • Additional connectivity checks
  • Uninstall/reinstall action
  • CRM registry info collected
  • Diagnostics surfaced in case submission process

Get the full scoop in the original post.

Tip #749: If your server-side synchronization is unstable

Unstable rocksLast week at the Hitachi Solutions Customer Conference, I lead a session about Server-Side Synchronization. One attendee asked me about an issue he was seeing where mailboxes would not stay enabled.

The following process has helped improve stability in other environments I’ve worked in, and it might help you as well if you face a similar situation.

  1. Set all mailbox records to Outlook synchronization.
  2. Set a small number of mailboxes to server-side synchronization and test and enable them.
  3. Wait a day or two and make sure that the mailboxes you enabled are working correctly.
  4. Set a few more mailboxes to server-side synchronization, and test and enable them.
  5. Continue this process until all of the active user mailboxes are enabled and working.

Be sure that all disabled users are not set to server-side synchronization. if there are any users who don’t need to be on server-side synchronization (such as users who are only ever working from the same computer, users who don’t need to track or sync, etc), either set them to Outlook synchronization or disable synchronization.

By following this process you can remove complexity from your sync deployment and improve performance by limiting server-side synchronization to only the mailboxes that need to synchronize.

Tip #748: Viewing Record Related News on MOCA

newsIn this video we look at the Company News Timeline feature that was release with Spring Update. This feature lets you stream news stories about CRM records on Mobile devices. In addition we show you how the Timeline Control works and is configured.

YouTube player

Give us your feedback, all of it: good, bad, and ugly, I’m sure we can take it. Suggest new topics either in comments or by sending your ideas to jar@crmtipoftheday.com.

Don’t forget to subscribe to http://youtube.com/crmtipoftheday.

Tip #747: If your view is broken

Closed binocularsIf you followed our yesterday’s tip and tried to set up a workflow automatically adding a user to a team, you may have seen the error message: “To use this saved view, you must remove criteria and columns that refer to deleted or non-searchable items.”

Broken view message

The fix is fairly straightforward: find the lookup view in customizations, remove the offending column and add back the proper one (Name).

Broken view

If you think that it will never happen to your views then wait until someone pulls out Xrmtoolbox and uses View Replicator to create a view referring to non-existing attributes.

Tip #746: Bring in the specialist

Bring in Mr WolfWashing car on weekend is something that everyone can do on their own. Probably. But if some serious cleanup is required, one’s better off calling Mr Wolf.

Same goes for complicated cases in customer service. If you run a secure shop that deals with the cases that include sensitive or personal identifiable information, then security roles and settings in your CRM system would be fairly tight. Now, what if you need to bring a specialist to a complicated case who otherwise wouldn’t have access to the record? Sharing, of course. And CRM has a mechanism just for that – auto-created access teams.

The only downside is that adding/removing user is a manual process. Wouldn’t that be nice if system could automatically bring a specialist to the complex cases requiring some extra care?

Now let’s assume that you can identify a specialist for the case. It could be as simple as a link from a case to a product (exists OOB) and from product to a user specialising in this product (you’d have to create this relationship). Or as complicated as a Azure machine learning analyzing past cases and figuring out who’d be the most efficient in resolving this or that case.

What is missing now is a workflow action to add/remove a user to/from the record access team. Good news is that this functionality is fairly simple to add. Some assembly is required.

public partial class MyActivity : CodeActivity
{
[RequiredArgument]
[Input("Select the user")]
[ReferenceTarget("systemuser")]
public InArgument<EntityReference> User
    { get; set; }

[RequiredArgument]
[Input("Select the team template")]
[ReferenceTarget("teamtemplate")]
public InArgument<EntityReference> Template
    { get; set; }

protected override void Execute(
	CodeActivityContext context)
{
    IOrganizationService svc = context
        .GetExtension<IOrganizationServiceFactory>()
        .CreateOrganizationService(null);
		
    svc.Execute(new AddUserToRecordTeamRequest()
    {
        SystemUserId = User.Get(context).Id,
        TeamTemplateId = Template.Get(context).Id
    });
}

With this custom activity you can now create a workflow that would automatically add a specialist to a case when required.

Workflow auto bringing the specialist

Tip #745: To Close The Unclosable Dialog

The first time you launch immersive Excel (also known as open in Excel Online) in a browser, you will get the following dialog:

analyzeyourdata

The problem is, in some browsers (like Edge on Windows 10), hitting the X does nothing.

To make this dialog go away, click the “Don’t show me this again” checkbox, then refresh your browser. The browser should then refresh to the same grid in Excel online, this time without the helpful dialog.

Tip #744: Manually accept invitations for disabled mailboxes

RSVPGuido “Trekkie not Star Wars fan” Preite with another tip on maintaining your mailboxes in hybrid environments:

In a CRM Online configured with an Hybrid Server Side Synchronization emails sent by a particular users moved to Failed state after few seconds (other users can send emails without issues). In the alert section of the mailbox the following message appeared:

“The email message Hello World! cannot be sent through the mailbox John Doe because one or more system users who are the sender or recipients in the message are disabled or have not accepted the invitation.”

Hybrid mailbox alert

The solution is to update the field “Invitation Status” inside the User form with the value “Invitation Accepted”.

Manually update invitation status

This field is normally read-only and inside a section called “Account Information” that is hidden by CRM, so it’s necessary to move this field out of this section and make the field not read-only.