Making Records Invisible In Dynamics CRM

CRM security is very powerful but it does have its limitations. One is that while it is possible to give someone access to a record they could not otherwise access, via Sharing, there is no clear mechanism to turn off access to a specific record. For example, let us say I work for that famous imaginary charity ‘MVPs For World Peace’ and the celebrity ambassador for the program is Ray Tomlinson, inventor of the ‘@’ symbol for emails. It is possible the events team need to capture their communications with Ray and book him as a guest speaker. However, being someone of note, it is not appropriate for everyone to have access to his details. Similarly, other notable characters may join the cause and they would also need to have their details restricted to only the events team.

Perhaps with the pending American elections, certain big name politicians may join the noble cause and different sets of users (the public relations team, for example) would need access to their information while restricting others.

So how do we set up a system in CRM such that we can create groups of Contacts (or any other entity for that matter) which only certain people can access and add records to the groups, as required?

‘Version 4’ Security Options

Back in the days of Dynamics CRM 4 we had the following tools in our security toolkit:

• Users can own records
• Visibility is at the user, business unit, business unit and child units or organization-wide
• Records can be shared with users and teams

To make records invisible on demand, we have to do something like change ownership of the record to a user in another business unit and use code to automatically share the record back to the users who are permitted access. The maintenance is messy and has the potential to clog up CRM with all the security exceptions that need to be tracked and constantly checked as records are accessed.

I have seen systems like this with literally millions of share exception records. They are unscalable and the only way to keep CRM functioning at an acceptable level is to constantly throw hardware at the problem.

2011 Security Options

The security model has changed slightly in CRM 2011 in that users AND teams can own records. Teams get a role assigned to them to determine they rights in regards to records so now all we have to do is set up the business units something like this:

In this scenario all users sit in the main business unit and have Business Unit access to all Contacts. Everyone can see all the Contacts in the system. We now create a child Business Unit and into it we add our restricted access teams (the Celebrity Team and the Political Team). These teams have a role assigned to them with user rights to Contacts. We also add the users to each team who we want to have access to the restricted records.

In the case of Ray Tomlinson, if his record is owned by a user, it ‘belongs’ to the Primary Business Unit and everyone can see it. However, if we assign it to the Celebrity Team, it now ‘belongs’ to the Restricted Access Business Unit which means no user can see it other than those who are members of the Celebrity Team and who have access to all records owned by the Celebrity Team. Problem solved, no code and no scaling issues.

Conclusions

There are many CRM 4 systems out there with complex code managing complicated security rules. If you are in this scenario, consider the new flexibility offered by the team ownership in CRM 2011. It is likely that by employing team ownership in creative ways, a lot of coding and maintenance time can be eliminated and CRM can be restored to a robust, scalable system.

An Alternative Method For Data Enrichment

I recently had a problem with a data import. The data had imported fine but a few hundred contacts were not imported with their email addresses (the client had forgotten to update the source data). The client had an Excel list of email addresses and ID numbers (not the GUIDs but unique integers which were imported and matchable) to identify the correct Contact in the database. Now all we had to do was ‘enrich’ the associated Contacts in CRM.

The Problem

The supported option for data enrichment is to export the records from CRM you wish to update and then use the import wizard to reimport them.

The problem in this case was there was no simple way to isolate the records that needed updating. I could have exported all the Contacts in the system and used a vlookup but there were more than 10,000 and the export from CRM, by default, is only good for 10,000 records.

It is possible to increase this limit but, in this case, we were on a deadline and the bureaucracy meant I was motivated to find another way, ideally codeless.

I could have used a lot of “Contact ID equals ######” linked by a Group OR but, given there were a few hundred records, I did not fancy this option either.

The unsupported option was to make direct update calls to the database but I try to avoid unsupported solutions unless absolutely necessary.

The Solution

There was no way for the import wizard to update the fields on an existing record (without exporting first) but I could add a child record to the Contact. In this case, as it was unused in the solution, I used the Opportunity entity. I used the topic field of the Opportunity to hold the email address and mapped the Customer using the ID (mapping to the correct Contact using the ID is done like this).

On top of this I created a workflow which, on the creation of an Opportunity, went to the parent record and updated the Contact email address with the value in the Opportunity’s topic field.

The result is we import our file of IDs and email addresses in as Opportunities. When the records are created, the workflow kicks in and updates the Contact linked to the Opportunity.

All we are left to do is bulk delete the created opportunities and remove the workflow.

Suggested Improvements

There was one other complication not mentioned above which was we also needed to populate an ‘Email ID’ field for integration to a third party system. This proved a bit tricky as it was an integer field and workflow will only populate an integer field from a money, float or integer field, not a text field. In the end I used the Freight Amount field but it is conceivable that, in the general case, either there is no child entity to use or, if there is, it does not have the right field types for workflow to copy the values across.

In this case I would create a new custom entity with the right fields on it, populate via import and use the workflow to flow the values up to the parent record. A little extra overhead but still only 15-30 minutes work, no need to get IT Administrators involved and no Excel formula fiddling.

Conclusions

If you need to update records and

• there is no simple way to isolate the records with an Advanced Find query
• there are too many to manually update them
• there are too many Contacts to export the entire list

This little trick will do the job. It is codeless and takes 15-30 minutes to set up and avoids the need for involving administrators, Excel formula, unsupported hacks or coded solutions.

Technology and Process and Building Trust

Trust is generated through experience. If someone says they will do something and consistently delivers, we learn to expect this will continue to be the case. This kind of consistency is referred to as ‘authenticity’.

I have talked before about the importance of authentic market communication. This was talked about over ten years ago in the Cluetrain Manifesto and is now part of multi-million dollar campaigns for companies such as Salesforce.

However, when it comes to living up to your promises, with so many ways to interact with customers, and, so many moving parts within an organisation, that can sometimes be hard. Even for those preaching the gospel to others.

How can technology help us ‘keep good’ on our promises or manage expectations when things go awry? Also, what should we do when we do fail to live up to our own standards?

Case 1: Microsoft’s Mobile and Cross-Browser Support for Dynamics CRM 2011

Back in February 2012, Microsoft put out some strong messages regarding the future of Dynamics CRM. Here is a copy of the old roadmap. Here is the summary picture of features to be delivered around the middle of the year.

This was very exciting and, like many partners, with new prospects we talked about the new features and when Microsoft expected to deliver them. The top three tiles in the picture are hot topics in CRM at the moment and resonated particularly strongly in presentations.

Then the sad news came in July, at the Worldwide Partner Conference, that some of the features would be delayed six months; mobility and browser flexibility. Official reasons are vague but reasons of ‘quality’ were cited. While I am not at liberty to expand on this what I can say is that the pre-release version, which was available to partners, was received very well and the reasons for the delay come down to coordinating the various components that make up the entire user experience and making sure this experience is the best it can possibly be. In short Microsoft apologised for a delay rather than deliver a frustrating process and disenfranchising customers.

The good news is last week at eXtremeCRM 2012, Microsoft has re-confirmed cross-browser support will be in the end of year update with a revised roadmap due any day now.

In this case, Microsoft made a promise then reset the expectation. Microsoft have communicated a clear deadline on which to deliver their new commitment. The cause, while vague, was some form of failure in the co-ordination of internal processes. Perhaps with better internal collaboration and communication e.g. using Microsoft’s SharePoint and Lync, the messaging to the market would have been set appropriately to begin with, avoiding the disappointment. One hopes Microsoft has learned from the situation and employed process and technology to avoid a repeat situation and to help meet the new deadline.

Case 2: Salesforce and the Social Enterprise

Back in 2011, at Dreamforce, Salesforce CEO Marc Benioff declared 'the “Cloud is dead” and the future is the “Social Enterprise”. What Marc meant by this was organisations will become increasingly reliant on social networks for marketing and will improve internal coordination and collaboration through technology. This was a strong shift in message given Salesforce had been ‘that cloud company’ until this point and was now aiming to become ‘that social enterprise company’. The idea of the ‘social enterprise’ was so strong that Salesforce sought to trademark the term in a number of countries, including USA, UK and Australia.

Unfortunately for Salesforce, the term ‘Social Enterprise’ predated Dreamforce by up to 30 years and meant an organisation devoted “to maximize improvements in human and environmental well-being”. Ironically, Salesforce’s 1/1/1 model is a great example of Salesforce being a traditional social enterprise.

An organisation vehemently opposed to Salesforce’s re-purposing of the term was Social Enterprise UK who established the “Not In Our Name” campaign and used those social channels to get their message out, eventually leading to the writing of an open letter/petition to Marc Benioff signed by various parties including a Nobel Peace Prize laureate.

A couple of weeks prior to the 2012 Dreamforce, at the start of September 2012, fearing protests, Marc announced Salesforce would back down with the quote being:

“It was never our intention to create confusion in the social sector which we have supported since our founding. As a result of the feedback we received, salesforce.com has decided to withdraw its efforts to trademark the term ‘social enterprise’ and plans to discontinue its use in our marketing.”

Salesforce should be applauded for seeing the light on this issue.

However, the removal of the term from marketing has not been as forthcoming. When Dreamforce started, the phrase was still a big part of the show.

Perhaps the two week lead-up from the removal announcement was not enough time to get the message out to the Dreamforce organisers. However, in the past month, while there have been some measures to remove the term from their marketing, there is still plenty of work to be done. For example, here is the Customer Success Site for different countries.

USA and UK (Customer Stories)

Australia, Germany, Italy and Spain (Social Enterprise Stories)

While Salesforce has changed the header for the USA and UK sites, they have not changed any other country I tried. Burberry may be totally connected but Salesforce’s messaging seems a little fragmented.

In this case I am not sure any more technology other than a cursory web search  and some internal collaboration was needed to avoid the situation in the first place. As for cleaning up the mess, Marc sent a clear message to the market but has only partly delivered on the promise. I can only imagine, in the case of a web page header that the cause is either:

• A lack of coordination and collaboration i.e. not everyone got the memo
• A problem with the technology i.e. fragmented systems which are taking time to update
• A lack of will i.e. Salesforce has no intention of dropping the term from their marketing

I assume one of the first two are to blame. Salesforce could employ collaboration software to help manage the process such as Chatter and Do.com or, if it is the second one, look to use site.com to house all their international web sites rather than, as may be the case, run them on isolated CMS systems. As with Microsoft, I expect Salesforce has reviewed the situation internally and ensured process and technology are in place to reduce the risk of it happening again.

The last option of a lack of will would be truly inauthentic and, given Salesforce understand the consequences of this in a social world, I doubt this is the reason. However, to avoid this perception in the market they should look to addressing the situation as quickly as possible.

Conclusions

No one wants to be thought of as a fraud, inauthentic or untrustworthy. However, even the best of us say one thing to an audience and have to revise our position at a later time. In the cases above, we have two organisations who set themselves a path but found they had to change their direction due to unforeseen circumstances. While tools, such as collaboration software, can help minimise these situations from occurring and be part of the solution for cleaning up the fallout, change is inevitable. The best we can do is learn from the situation and employ technology and process for better control in the future.

Ultimately, the measure of these companies is not that they had to reposition themselves, or the technology they use, but how they handle it. In the case of Microsoft, a new deadline has been set for delivery of the features and they will be measured accordingly. In the case of Salesforce, while a new marketing direction has been locked in, there is still no deadline for when the ‘social enterprise’ phrase will be removed. If they do not set an expectation, their audience will, outside of Salesforce’s control, which is unlikely to end in a positive outcome.

In other words, while technology can help manage our business better and promote internal consistency, we must always consider whether we are being perceived as authentic and this can only come from setting clear, measurable promises and delivering on them (SMART goals). In terms of delivering the features for CRM, Microsoft has done this. In the case of Salesforce, their new goal is not SMART as it is lacking a time component and this needs to be addressed to reduce the risk of damage to their reputation.