Bad CRM Security Habits To Break

This time next week I will be on a plane heading to the MVP Summit at Seattle/Bellevue/Redmond. So, if you have any questions for the Microsoft Dynamics CRM Team in Redmond, feel free to add them below. I promise to ask all the questions you post (even the cheeky ones) and, for the answers which do not get me kicked out of the MVP programme, I will post the responses.

To the blog. There are some bad habits, when it comes to security, which are a remnant of previous versions of CRM (and from just doing things to cut corners when under pressure). I will show you what they are, why they are “poor man’s security” and the better approach.

Hiding Fields

Before CRM 2011, there was NO comprehensive field level security. Essentially, if you had access to the record, you had access to all the fields on the form. There was no way to let one user see a field on a record and guarantee another user could not see it. You could work around things a little bit with things like using jscript to hide tabs or hide fields on the form but you could always add the field as a column in an Advanced Find and see its contents this way. Even if the Searchable property is marked to ‘No’ this just means the field is not available as a condition for the Advanced find; it is still available as a column.

A cursory search on the internet generates many claims of field level security for CRM 4. There is even a Microsoft white paper on the ‘workarounds’ for version 4 which describes how plug-ins can be used to block the Advanced Find workaround above. However, the paper acknowledges the plug-ins cannot intercept access to the Filtered Views, as is done with Dynamic Excel exports.

Therefore, even the commercial products on the market at the time claiming field level security , unless they knew more than Microsoft themselves, either used unsupported methods or were not complete.

In my experience of CRM implementations back then, given the option of a comprehensive (and expensive) plug-in solution or some cheap jscript which was not airtight but did a rough job of it, the client picked the jscript every time. These systems are now being upgraded to CRM 2011 and, frankly, there is no excuse for this nonsense in a CRM 2011 system.

The Better Option for Fields

In CRM 2011 we now have proper field level security. When configuring the field, you tick the box.

Then you set up a security profile and say which users or teams can access it.

Ideally, in my opinion, the security profiles should be linked to a security role, rather than a user/team, to simplify on-going administration maintenance (users come and go but roles remain) but, given we had nothing before, this is a vast improvement.

Hiding Entities and Poor Assumptions

This section covers a couple of entity security sins. Firstly, the obvious one. With the sitemap, it was always possible to ‘hide’ entities by editing the XML. After all, if a user cannot click on the entity, they cannot access it, right? The second sin is the poor assumption that entity security ends with configuring user access via the security roles. For example, if we want to secure activities, all we need to do is set up our Business Units and set up the correct security roles, right?

The answer in both cases is, surprisingly (especially in the second case), “no”. Again, the CRM hacker’s favourite tool, Advanced Find undoes our good intentions.

In the first example, the Advanced Find lets us access all entities (even ones not linked to any other entity e.g. configuration setting entities, or in the sitemap). In the second example, while it is true we cannot access the activities (CRM security is sufficiently robust for that), we can access the child records such as notes. If there are good reasons to secure appointments, it is a fair bet that the same rules need to be applied to notes. If not, a user could pull up Advanced Find and access all the note records in the system and probably access inappropriate information. When setting up security, never forget the child entities, especially notes.

Conclusions

Security configuration in CRM has come a long way from version 4 but some habits die hard. Field level security should not be confused with user experience design and, now the tools are there to set field level security properly, they should be used. Also, when considering the security required to meet a business’ needs, think of the information being held, not just the entities otherwise notes will trip you up every time.

Good luck.

Monitoring the Skills of Your CRM Team

This is another one of those ‘CRM manager’ posts that occasionally sneak in, mainly because I am running the local CRM team now. However, it is a tool even a member of a team could use to see where the weaknesses in their team are and decide whether to up-skill themselves or, at least, raise it with management to score some points with the boss. In my case I used it as part of my 12 Month Plan for the CRM team.

As the title suggests, this tool is about monitoring the skills of a CRM team to ensure there is a healthy mix for when projects come along or to mitigate the ‘under the bus’ factor.

The Under The Bus Factor

Also known as the ‘win the lottery’ factor, this is a nice way of talking about staff contingency; if you only have one person who can code and they get head-hunted you are either hiring really quickly (a good recipe for getting someone who is not a great fit for the business) or outsourcing and losing profits. In my opinion, having at least two people who can perform an essential skill as well as each other saves a lot of headaches. Not only do they often bring different wisdom and experience to the table, making the sum greater than the parts, but it provides a way to quality check each other’s work.

The Essential Skills For CRM

In my experience, there are three broad categories of CRM consultant:

• Functional Consultants
• Developers
• Infrastructure Experts

Functional Consultants (which is where I place myself) know how the product works from a user’s perspective. They are often the most client-facing of the consultants and conduct things like workshops, deliver training and the like.

Developers are the ones who stretch the product beyond what the Functional Consultant can deliver; when the client insists on a specific piece of functionality and it simply cannot be configured and be practical through settings, the developer comes in to show what the underlying platform can do.

The Infrastructure Experts are the ones who love to design server configurations to make systems sing. Setting up clusters and farms is their thing and they get excited when a client asks for ‘high availability’ because it means they can throw everything they have got at the problem. Even as CRM deployments go ‘in the cloud’ there is the need for an Infrastructure Expert so ensure things work on the client’s side and to ensure the cloud CRM deployment effectively works with local, non-cloud applications.

Often they are also the ones who actually install and set up the base platform.

Despite using three categories, they are not mutually exclusive; there are developers who can deliver training, for example. However, in my experience, consultants have one of these as their primary skill and perhaps a second as a secondary skill. Their primary skill is their key strength but they dabble in other areas.

The Skills Matrix

So let us say we have a CRM team of three: Tom, Dick and Harry. We can assess them or they can assess themselves in terms of the three categories, putting a ‘P’ for primary or an ‘S’ for secondary in front of each skill. I quite like the idea of self-assessment because when it comes to a project and that skill is needed, they have taken ownership for delivering that aspect of the project by stating they are an expert in that skill.

Maybe we end up with a matrix like this:

	Tom	Dick	Harry
Functional	P		P
Developer	S	P
Infrastructure		S	S

In other words we have Tom and Harry the Functional Consultants and Dick the Developer. Finding the strengths and weaknesses of the team is then a case of reading across the rows and assigning a numerical value to the letters, if you choose. In this case, it is fairly clear the team has a weakness in infrastructure knowledge.

The decision is then:

• Focus on projects with limited infrastructure challenges
• Up-skill an existing member of the team
• Bring in a new person, Jane, whose primary skill is infrastructure configuration

The Expanded Skills Matrix

In the case of my 12 month plan, I expanded these skills out to:

• Conducting Requirement Workshops
• Presales Demonstration
• Documentation
• CRM Configuration (no code)
• Training
• Client-Side/Form scripting (j-script)
• Server-Side coding (.Net)
• Infrastructure Design
• Implementation Setup

From the resultant matrix it became clear where the team was strong and where there was room for improvement. This information then fed into the plan for the team in terms of hiring and training.

I am sure, as the product changes, this expanded list will evolve. It is possible that html5 skills will be needed in the future, as Silverlight skills are needed today. This may be rolled into the Server-side coding bucket or be listed as a skill in its own right.

Conclusions

Whether you are managing a CRM team or are part of one, a skills matrix can give you a quick picture of how the team stacks up in terms of delivering projects. One aspect I like of this approach is it is relatively simple for team members to self-assess. Nothing generates groans faster than asking a team to fill in a skills assessment but by fixing the categories and giving them a simple ‘P’ or ‘S’ scoring system, they should be done in five minutes without too much difficulty.

Book Review: Packt Microsoft Dynamics CRM 2011 Customization & Configuration (MB2-866) Certification Guide

 

Introduction and Disclaimer

As they did this time last year, Packt have asked me to review one of their online books in exchange for a free download of it. Again, if you are interested in buying it, here is the link.

I have known the author, Neil Benson, online and offline for at least a couple of years with most of our real world contact happening at the MVP Summit.

He is a man I have a great amount of respect for and demonstrates he is a man of refined tastes in two ways:

• he has partnered up with an Australian woman
• he has a passion for excellent scotch

As with the last Packt review, the timing of the review is impeccable. The MVP Summit is less than a month away and I am sure there is a wee dram or two in it for a complimentary review. Despite such excellent prospects, I will try to be as impartial as I can.

The Microsoft Certification Process

The Microsoft certification process is an interesting quirk of working with Microsoft products. The idea is certification demonstrates familiarity and knowledge of the product. In theory it shows a level of expertise in a specific product beyond that of the uncertified. Neil talks about this in the preface.

In reality, while the Microsoft Official Curriculum (MOC) and course are excellent for learning an aspect of a Microsoft product, one can put the exam code (in this case “MB2-866”) into a search engine and find “Actual Tests” for less than, say, the cost of this e-book I am reviewing. These are very similar to the tests given for certification and the unscrupulous could easily memorize the answers to 80 specific questions and pass without any real-world experience with a product.

A couple of factors encourage this poor behavior. Firstly, Microsoft recently changed the rules for organizations to be a certified gold or silver partner with them. One part of the criteria is a certain number of certified staff. With time being money, this puts pressure on organisations to take ‘short cuts’.

The second factor is the nature of the questions. In my case I received training on Dynamics CRM back when it was Microsoft CRM 1.0 beta. I have consulted with the product since v3.0. However, despite implementing many CRM 2011 projects and being considered an expert with the product, I still fear not being able to pass the exams. Why? Because the questions are written to trip you up or they cover aspects of the product which are easy to discover when it is front of you but are not often memorized. For example, a configuration question could be “What is the default starting value for custom option sets?” Off the top of my head I have no idea. Do I know how to find out with the product in front of me? Sure. Have I ever needed to know this? No, but it is a legitimate question in the sense that it relates to the product and has a well-defined answer.

Am I suggesting you ignore books such as this one and get a '”brain dump”? Not at all. If you need to “tick the box” it is an option, but if you are working with a product (Dynamics CRM) in the capacity the exam covers (customization and configuration) a brain dump will do you no favours. If you are studying to work with a product, get the MOC materials, do a MOC course or get a “MOC-proxy” such as this one. If you are nervous even after studying, there is always the option of ‘sanity checking’ your knowledge with a test exam but I never recommend they be used, even to my staff, for anything other than to uncover weaknesses in an already established body of knowledge.

Finally, the MB2-866 exam is not a coders exam, despite the title. In this case, customization and configuration refers to setting up the environment e.g. configuring audits and currencies and modifying the system through the interface without code e.g. adding new fields or forms. The skills tested are those required to do things like set up pre-sales demos, configure a system ready for coding or provide on-site ad hoc modifications to a client.

The Reviewers

The four reviewers for the book are:

• Michael Ferreira
• Joel Lindstrom
• Tanguy Touzard
• Jerry Weinstock

I do not believe I have met Michael but I know the other three very well and even shared a room with Tanguy at last year’s MVP Summit. What I can say about these gentlemen is they are all existing or former MVPs so they know the product and value their reputation (given this is the measure by which we get renewed). They have strong reasons to make sure this book is as good as it can be.

Overview and Structure of the Book

The book is just over 300 pages. The chapters are:

• Preface
• Chapter 1: Overview of Microsoft Dynamics CRM 2011
• Chapter 2: Configuring the System Settings
• Chapter 3: Configuring the Organization Structure
• Chapter 4: Entity an Attribute Customization
• Chapter 5: Data Modeling Using Entity Relationships
• Chapter 6: User Interface Customization: Forms, Views and Charts
• Chapter 7: Auditing
• Chapter 8: Solutions
• Chapter 9: Sample Certification Exam Questions
• Appendix A: Answers to Sample Certification Exam Questions
• Appendix B: Answers to the Self-test Questions
• Appendix C: Introduction to Microsoft CRM Training and Certification

If we compare the size to, say, Matt Wittemann’s CRM 2011 Administration Bible, we see it is about half the size (although the last 100 pages cover preparation and a sample exam, rather than exam content). However, this one is a lot more focussed, covering only the topics needed for the exam e.g. installation is not covered here but is in Matt’s book. Using Matt’s as a benchmark it seems, in the areas it covers, this one is quite comprehensive.

Preface

The exam syllabus link in the document did not work for me, but you can get an overview of the exam here:

http://www.microsoft.com/learning/en/us/exam.aspx?id=mb2-866

From this, we see the topics covered in the exam are:

• Configuring a Microsoft Dynamics CRM Organizational Structure
• Managing Users & Teams and Security
• Customizing Attributes and Entities
• Customizing Relationships and Mappings
• Configuring Auditing
• Managing Forms, Views, and Charts
• Implementing a Microsoft Dynamics CRM Solution

which closely mirrors the chapters in our book.

The preface is clear this is a book of what you need to know, rather than a book of best practices, such as the CRM Field Guide (plug, plug) which Neil was also an author for (as was I). This being said he does slip in the odd best practice where it makes sense.

The preface explains there is a “Test Your Knowledge” section at the end of each chapter and a sample 75-question test exam at the end of the book. The preface is also crystal clear that this test exam is NOT a brain dump but simply an exam in the same style as the official one.

While no guarantees are given, Neil makes it clear that he firmly believes learning the content of the book is sufficient to pass the exam.

The preface gives a brief description of the chapters (which I purposely skipped over so I can give you my own overview without interference) and outlines what you need in addition to the book i.e. a working CRM environment to play in.

All good so far…

Chapter 1: Overview of Microsoft Dynamics CRM 2011

This chapter covers areas including:

• The technical architecture of CRM (in a way that means even I now understand what multi-tier architecture is)
• Supported and unsupported customisations. This is about as technical as you need to go for the exam. In short, while no coding knowledge is really required, it suggests you do need to know where that code can be applied and what layers of the architecture can be modified. The reason for this? If you are designing a CRM system, you need to know where codeless changes end and coded changes begin and the broad limits of what code can so in a supported fashion
• Deployment options (and their differences)
• Customization security roles (system administrator and customizer and the difference between them)

There is also a nice summary of the chapter at the end (and at the end of all the chapters). If you are already knowledgeable about CRM and want to know if it is worth reading a chapter, this summary could be a good place to start; If you learn something new, the chapter might be worth the effort.

There is no ‘Test Your Knowledge’ section for Chapter 1 which makes me wonder whether this is examinable or not. Either way, it is a good foundation for CRM in general and the content that follows.

Chapter 2: Configuring the System Settings

This chapter begins with a blow-by-blow review of the system settings you can set for CRM. This is quite dry but absolutely necessary for an exam e.g. can the report categories be modified and how?

The chapter then gives some context to the settings in terms of Outlook and even covers the options a user can set for the Outlook client.

Finally, the chapter talks about which settings can be bundled into a solution and migrated to another CRM system.

Probably not a chapter to read if you are sleepy but comprehensive none the less.

Chapter 3: Configuring the Organization Structure

This is, essentially, the security chapter and it is quite a large topic these days given security is affected by:

• Business unit structure
• Record ownership (user or team)
• Security role setup
• Field security settings
• Form security

All these elements must come together in a CRM solution to ensure the right information is delivered to the right people and sensitive information is contained, as required. This is not a trivial topic to cover and is much more complicated than it was back in the version 4 days.

What I do like is Neil’s emphasis that the business unit structure is not there to reflect the real divisions in the organization but is there to manage security. Too often people set up business units for no better reason than it reflects the org. chart. Keeping it simple and setting it up purely to manage security needs will always pay dividends in the long run.

In terms of licensing, Neil is clear; he sticks to what you need to know, no more. As he correctly points out, with all the deployment options, licensing is a complex beast (to the extent there are organisations out there whose sole purpose it to provide advice to ensure you are correctly licensed with Microsoft products).

He covers one of the more complex aspects of the 2011 security model: team ownership. Even the most battle-hardened CRM veteran gets tripped up by this so it is good to see a no-nonsense summary.

Security role setup is covered and, again, a few best practice tips are given e.g. “copy a role, do not create from scratch”. Neil also covers the behaviour of security roles when they are assigned to users.

Finally, Neil covers what is left e.g. things like form security.

In terms of a text summary of CRM 2011 security, this is one of the best I have seen. Whenever I am asked by a client to describe security in CRM, a shiver of dread runs through me. Neil has tackled the job and made it seem effortless. This chapter and a trial instance of CRM and you will be a CRM security guru.

Chapter 4: Entity and Attribute Customization

For me, this is the core of CRM customization. In transforming an out-of-the-box CRM system to a practical system, I believe getting the data structures right and setting up the fields right is essential. This chapter covers the creation of the entities that make up those structures and their fields (linking the entities comes in Chapter 5).

Neil provides a comprehensive review of entity settings and a few more best practice tips. He even talks about where the official courseware is in error and where exam questions may also be in error to match.

He then moves into custom fields (he even explains the difference between decimals and floats and what IME Mode is).

Field level security is covered as is option sets (local and global).

A good high-level review of entities and fields. Again, with a demo system to practice with, this provides the foundation for a good working knowledge for the exam.

Chapter 5: Data Modeling Using Entity Relationships

Neil talks about the kinds of relationships that are permitted and those that are not (fight the good ‘polymorphic’ fight, Neil). He goes into detail such as cascading behaviors and mappings. Finally he talks about ad hoc modelling (Connections).

Again, a good introduction to entity linking which covers the basics for an exam.

Chapter 6: User Interface Customization: Forms, Views and Charts

Moving from the backend structures, Neil now moves into modifying the front end. Firstly, he covers form modification (mobile and client and even calls out read-optimized forms) and form security (answering why role-based forms are not secure).

He then moves into describing the various views used in CRM and how to create new ones.

Finally, he talks about chart creation, how to add them to entities and gives a great table showing the different types of charts with a handy graphic for each one. He also covers exporting and importing charts for customization but, as this is beyond the scope of the exam, does not cover their customization in detail.

An excellent overview covering the essentials.

Chapter 7: Auditing

Neil talks about what the auditing function monitors and some of the limitations of in within CRM. He covers audit configuration and audit security.

A relatively simple chapter but one that covers all aspects of auditing in CRM.

Chapter 8: Solutions

Chapter 8 is the last of the ‘content chapters’. The last chapter and appendices covering the sample exam and preparation information. The idea of a solution is new to CRM 2011 and is a complex subject. However, Neil navigates the essentials with deft elegance, clearly explaining the difference between managed and unmanaged solutions when it comes to deletion and application to a new environment. Neil even provides mnemonics to help the reader remember some of the trickier aspects for solution conflict resolution.

Solutions are complicated to the point many of us avoid using managed solutions unless absolutely necessary and generally not worrying too much about them. However, such an attitude does not pass exams. Neil covers what you need to know to pass the exam and with a bit of practice on a demo environment or two, the behaviour should become a little more intuitive.

Chapter 9: Sample Certification Exam Questions

This is a set of 75 exam questions cast in the format commonly seen in Microsoft exams. While the format mimics the Microsoft exam, the wording in these questions, at least to me, seems clearer than the real thing. However, given the adrenaline that is often running through one’s system when doing a real certification exam, this perception may be biased.

Appendix A: Answers to Sample Certification Exam Questions

These are the answers to the questions in Chapter 9. Neil also provides detailed answers as to why the incorrect options are wrong.

Appendix B: Answers to the Self-test Questions

These are the answers to the ‘Test Your Knowledge’ sections at the end of each chapter. No detailed explanations are given here but one assumes you can always refer back tot he chapter to see the reason for a bad selection.

Appendix C: Introduction to Microsoft Dynamics CRM Training and Certification

This initially gives an overview of the certification courses and exams available for CRM 2011. It then provides one of the most useful sections in the book; a guide to exam preparation, a review of how to book the exam and a summary of what to expect in the exam taking. Neil also includes tips on making the best use of your time in the exam.

Finally there is an index for quick reference.

Conclusions

If you cannot attend the official curriculum course and/or get hold of the MOC materials, this is an excellent substitute. It could also be used to supplement the MOC materials to ensure a completely thorough knowledge of the subject as well as providing some good tips when in the real world.

Overall, I am impressed with the effort Neil has put in. Adding nice touches like Appendix C and the test exam make for a more complete document than, say, the MOC material alone. He has also put in the effort of calling out changes implemented in CRM via rollup updates (and likely to be in your test system) but which were not available at the time the exam was put together.

If you are looking for a cheap version of an administrator’s guide, this is not the book for you. It is very focussed in its coverage and is more intent on teaching the how to modify functionality in CRM than in providing consulting excellence advice. The only question that really matters is whether this book will help someone prepare for the Microsoft exam. In my opinion the answer is an emphatic “yes”. Neil covers all aspects called out as being part of the exam and provides real world guidance for when the reader applies their knowledge in the wild. He also provides advice on maximizing your chances for success when in the actual exam. If you are preparing for the MB2-866 exam, simply put, this is money well spent and complimentary to the other tools usually employed (MOC materials and brain dumps).

If you are keen to give your knowledge a good working out prior to sitting the exam, Neil’s book can only assist. The “Test Your Knowledge” sections and sample exam ensure your knowledge is everything it can be prior to sitting for certification. If you are about to sit MB2-866, good luck.

The Future of the Office and the Cloud (What is the Cloud?: Part 2)

This follows on from a post I did about 18 months ago called What is the Cloud? and follows on from an excellent discussion I had on the weekend with a good friend of mine who works at VMWare. Back in the “What is the Cloud?” post I described how a computer works and then used this as a model for describing the various modes in which cloud computing is used i.e. IaaS, PaaS and SaaS.

The Debate

The debate had on the weekend was concerning Bring Your Own Device (BYOD). This is the idea that employees want to bring their own technology to work rather than use the company’s. There is no doubt this is an emergent trend and, in the case of mobile phones, I would suggest the battle has ended. In my case, while I often will be issued a corporate mobile phone, I generally forward it to my personal phone and just use this. It is very difficult to enforce against a BYOD trend in the case of phones when it is so easy to forward phone calls.

However, in the case of the work device e.g. PC/laptop, various models are still in play in the workforce.

Workplace Models for Work Devices

In my experience with organisations, I see three models at play:

• Traditional: Work Device = corporate owned
• BYOD: Work Device = employee-owned
• Dumb Terminal: No device (Screen, keyboard and mouse with all application and data provided remotely)

In the case of the first two, certainly at NEC, we operate in a hybrid mode i.e. some people use NEC’s devices and others bring their own.

Forces at Play

People Are Caring Less About Where Their Data Are (Storage Indifference)

For me, I want all my data in the cloud (see Moving To The Cloud Parts 1, 2 and 3). Back in the old days I had to do regular backups (never happened) and if I needed to access information outside of the home, I was hamstrung. While I still maintain you lose control by moving to the cloud, the benefits, for most, outweigh the costs in my opinion.

Organisations are still concerned by going ‘all in’ with the cloud because of security and uptime concerns but I believe these concerns will diminish over time.

The Internet is Getting Faster

In Australia, and other countries, the old copper lines originally installed for phone calls and adopted for data, are being replaced by fibre optic lines. Fibre optic can transmit data at crazy-fast speeds relative to copper line technology with other advantages such as less loss of signal (ideal for Australia given the size of the place).

Companies Want to Secure Their IP

Whatever model is employed in the future, the intellectual property of the organisation must be protected. There is no doubt employees are influencing the direction of IT policy but governance must be maintained.

Companies Want to Reduce IT Support and Maintenance Costs

If there is a model which means companies spend less with negligible disadvantage, this is a model they will adopt. Nothing can resist the forces of economics.

Employees Getting Frustrated With Stuff Not Theirs

Employees want to work with their ‘stuff’. They can fix it quickly without going to IT support and they know where everything is. For power users, their equipment may also be more powerful than what is provided by the organisation so using their technology reduces frustration and potentially increases productivity.

Consideration of the Models in Light of the Forces

Traditional

Of the five forces, the main forces which impact the traditional model are the last two. Economically, the BYOD and dumb terminal models have the potential to be cheaper from a maintenance perspective. From a user’s perspective, there is a misalignment between the devices delivered by IT and the needs and wants of the user. Often a user’s home device does a better job of meeting their requirements.

BYOD

The last three forces impact the BYOD model. One of the big worries with BYOD is the security of information held on the user’s device. However, using remote desktop technology (in some ways turning the user’s device into a dumb terminal) can remove these problems. BYOD also reduces support costs as long as a policy of “user device – user problem” can be enforced. Effectively the cost of support is off-loaded from the organisation to the employee. Finally, any frustration of having to use a corporate device are removed in BYOD leading to happier and more productive employees. Forrester studies back up the notion that users are more productive in a BYOD model.

Dumb Terminal

The only real difference, in regards to the forces, from an organisation’s perspective between this model and BYOD is a dumb terminal is not the user’s own device. However, assuming all applications are available for the user and their performance is not hindered I cannot see why this model would not be acceptable to the average user.

The Short Term Winner

Based on the above, I think the short term winner will be BYOD although it will be a slow move. The adoption of ‘security wrapper’ technologies to make CIOs and IT managers more comfortable about third party configured environments coming onto the network will not happen overnight.

While users want the right to use their stuff, I am not convinced they are willing to accept the responsibility of managing their own device. The application of “user device – user problem” policies, without any form of compensation, will be resisted, especially at organisations with employees who must use computers but who are not power users. Being forced to source a machine for work use and pay for support is not something that all employees will delight in.

The force that will drive BYOD is the economic one: the belief by organisations that it will save them money. I am not convinced by the simplistic purchase saving arguments. Depreciation takes care of those. However, if employees are taking care of the maintenance of their device and there is little disadvantage to the organisation in delivering applications to the devices, there should be savings in that area.

Why The Cloud Changes Everything

Let us now project to a future of fibre where the internet is crazy-fast and ubiquitous (at least 10 years away for Australia). Consumers and many organisations are comfortable storing their data and sourcing their applications from the cloud. Perhaps we no longer have the equivalent of our desktop/app page running locally but run it from the cloud as well. Think of a Chromebook, without the problems or a PC running an equivalent of Cloud. Is BYOD still the winner?

In this world, the device is irrelevant. If I am accessing everything from the cloud, including the equivalent of my desktop/app page, as long as I have a device which connects to the internet everything just works.

In this world the Dumb Terminal/No Device model is the winner as it ticks all the boxes and offers little disadvantage to any party.

• Force 1: Everything is in the cloud so as long as I have a connected device, my world is at my fingertips (or eyes) and it all just works.
• Force 2: The speed of the internet is such that applications are delivered without issue and because they are running in the cloud local device specifications are irrelevant
• Force 3: Future cloud security is sufficiently smart that it is no longer feared in the same way encrypted hard drives remove the fear of laptop loss today
• Force 4: I provide a set of dumb terminals to access the corporate cloud applications and data. Terminals specifications are irrelevant as everything is running from the cloud and maintenance is minimal
• Force 5: Employees no longer care about using their device because all devices, from a data and application access perspective, are equal in this world.

Conclusions

The cloud is where the information will live, but not yet. Attitudes and technology need to catch up first. While that is happening people will carry their data with them and their own devices. When they go to work they may be asked to use other devices connected to other sources of data and be asked not let the two connect. Given our personal and working lives are mingling through tools like social media this will slowly erode as people get frustrated with the artificial barriers.

As attitudes change and technology removes the excuses, our lives and our actions will be recorded on a server ‘somewhere else’ via the internet. This applies to individuals and organisations. While we will have ‘home devices’, ‘mobile devices’ and ‘work devices’ and the form factors may change to suit the need, their basic function will be identical; to attach to the internet where we do stuff and record stuff. The world will be a giant dumb terminal plugged into a cloud of applications and information. Of course, making predictions ten years hence is the actions of a madman, but I am excited to see where the rollercoaster takes us.

Creating a Strategic Plan

A few weeks ago my boss asked me to put together a twelve-month plan for the CRM team. He wanted me to identify things like:

• Areas where the CRM team are weak and strong
• Ways to align the CRM team to the values of the business
• Opportunities in the market to pursue

If you are given this task and never done a strategic plan before it can seem gargantuan but with a few tools, you can put together a plan like an MBA graduate without too much stress.

The Mantra of the Strategy Plan

Any kind of strategic roadmap-type plan seeks to address three questions:

• Where are we now?
• Where do we want to be?
• How do we get there?

I generally add these headings in the document and tackle them one at a time.

Where Are We Now?

I break this up into the external analysis (what is happening outside of the organisation) and the internal analysis (what is happening within the organisation). In the case of being a reseller, I also consider the external and internal analysis of the product i.e. for Dynamics CRM, what external factors are affecting the product and what factors within Microsoft are driving the product.

For the external analysis there is the very useful PESTEL analysis (or one of its variants). PESTEL stands for:

• Political: Government policy affecting operations/product
• Economic: Economic factors affecting operations/product
• Social: Cultural aspects affecting operations/product
• Technological: Technology changes affecting operations/product
• Environmental: Climate and weather factors affecting operations/product
• Legal: Laws affecting operations/product

I generally brainstorm anything that comes to mind that may have a bearing on business in the next five years. For example, whether businesses are moving to the cloud or not is a technological factor that could affect operations.

Once you have the PESTEL analysis laid out, you may also want to consider aspects such as the strengths and weaknesses of your competitors or, in the case of a product, the strengths and weaknesses of competitive products.

When all the external factors are documented, it is time to consider the internal factors which affect operations. For example, it may be the strengths and weaknesses of the CRM team or the values of the business which the CRM team are expected to follow. Perhaps it is the industries the CRM team have worked in and how a strong vertical presence may be an advantage in winning new work.

Where Do We Want To Be?

If your bosses are communicating a clear vision of where they expect the business to be and when, this is where this feeds in. If not, you can derive some potential directions using a SWOT analysis.

SWOT stands for:

• Strengths
• Weaknesses
• Opportunities
• Threats

Again, these are broadly considered internal (strengths and weaknesses) and external (opportunities and threats). We now feed the PESTEL factors into this and, to find a path for the future, we try to match up strengths and opportunities and weaknesses and threats. Directions will present themselves as ways to exploit opportunities using our strengths or mitigating threats by reducing weaknesses.

For example, let us say from our external analysis we know that none of our competitors have a Business Intelligence (BI) practice and from our internal analysis we know we do. Our strength in BI now presents a market opportunity if, for example, the market is interested in BI tools for their CRM system. We are uniquely positioned to serve this need.

For those factors which do not provide an insight into a potential direction, we can remove these from the document.

In my case I derived about half a dozen Strength-Opportunity pairs and half a dozen Weakness-Threat pairs. Using the direction provided by my boss I filtered these down to directions aligned to the larger goals of the business.

How Do We Get There?

The final step is putting together some meaningful actions to head in the right direction. I generally set for each ‘direction’ a 0-12 month action (broken into four quarters), a 1-5 year ‘action’ and a 5 year plus ‘action’. Obviously each action feeds into the action for the next timeframe. So, in the case of the BI opportunity, out first four quarters might be:

• Quarter 1: Liaise with the BI team to see if they are keen for a joint venture
• Quarter 2: Put together a cross-function team to develop a trial offering
• Quarter 3: Offer the trial to existing clients as a free product on condition of regular feedback and thoughts
• Quarter 4: Incorporate initial feedback into the offering and liaise with marketing to promote it

This then feeds into our 1-5 year action which might be “having a market-ready BI offering for Dynamics CRM”.

Our 5 year action may be “be the market leader in BI for CRM”.

Conclusions

Obviously not my usual blog topic but if you need to put something together to give you a bit of direction on where to head either at work or maybe even for yourself, this might give you a few ideas on how to approach it. My advice is start with the PESTEL and you will soon find the rest falls into place. Good luck.

A Couple of Form Security Tricks

Forms have come a long way in CRM 2011 and here are a couple of tricks I use a fair amount.

Hiding Locked Fields

Some forms have fields which simply cannot be taken off the form. A good example is the Account Name field on the Account entity.

While we can stop the field from being compulsory, by going to the field settings, we cannot remove the padlock indicating it is locked to the form (and any other forms we create from this one).

The solution is we hide the field in a hidden section. If we create a new section on the form, we can set its properties to be not Visible by default:

All we then do is drag our locked field to this hidden section and we no longer see it on the form.

Please note: If you put a compulsory field in a hidden section and try to save the record it will automatically expose the hidden section so you must make the field not compulsory for this to work (or autopopulate it via jscript OnSave). Also, as in my example, if you are hiding the default name attribute, populate it by using either a jscript or workflow because, otherwise, any child record will show a blank lookup reference, which can be confusing for users.

Dodging Compulsory Fields

Let us say you have a two-step process for handling cases. The call center team receive the emails, quickly reply to the simple queries and convert the trickier ones to Cases for the resolution team. The resolution team then get into the details of the Case and resolve it. It is conceivable that the call center team will not need to know as much detail as the resolution team and, being a team which is dealing with high volumes of queries, simply do not have the time to get bogged down into finding out the important information. It makes more sense for the resolution team to find this information out as part of their investigation.

In version 4, this meant we had a problem. If there are key fields on a Case form needed for things like business reporting, assuming they are compulsory, they must be filled out when the Case is created. Even today, many consultants will tell you to get around the problem we either relax the compulsory nature of the fields or write some tricky jscript to check the role of the user and tweak the fields dynamically.

With 2011 there is a little known alternative approach using forms. As you may know we can create multiple forms for a given entity and assign them to different security roles. We can even create roles with no actual security rights but use them as a way of giving forms to users.

In our case, let us create two forms: one for the call center users and one for the resolution team. We will take the detailed form with all our compulsory fields on it and ‘Save As’ to act as a template for our call center version. The problem comes when we try to remove the compulsory fields; the computer says ‘no’.

To get around this, we do a bit of a supported hack/workaround. We go to the field in question, make it non-compulsory, come back to the form, remove it and then make the field compulsory again (you will probably need to publish the changes between these steps as well).

The net result is we have a form with a bunch of compulsory fields missing from it. What is great is the form does not complain when the call center staff use it and hit the save button; it seems saving only checks the fields on the form in visible and hidden sections but not the fields off the form. This means the call center can create the seedling of a Case, assign it to the resolution team and, because the resolution team only have access to their detailed version of the form, they are forced to fill in the rest of the compulsory fields. No code needed and no compromise to what the business needs to capture.

Conclusions

If you are looking at form design and working with forms for entities like Cases or Products, you may have come across the kinds of problems mentioned above. With any luck these tips might save you some angst and code writing, enjoy

CRM: Culinary Recipe Management and Socialisation

In the spirit of my CRM Adventure Game and CRM Hangman I now present using CRM as a recipe database. This is a pre-cursor to my ultimate dream of creating a CRM cocktail database.

There is not much of a lesson here (although I do propose a very practical business use for this a little later on) other than it is something I wanted to do to show the flexibility of the platform (and because I am now doing the cooking in the house and wanted a way to ask “If I have ingredient ‘x’, what can I cook”). As usual, everything I have done here I have done without code and all up has only taken a few hours at the keyboard while watching TV.

The Structure

Pretty simple stuff, although I will likely extend it as time goes on.

Essentially, we have a recipe with ingredients. These ingredients are basically a food item with a measure e.g. 1 teaspoon of vanilla essence. A recipe also has equipment used to make it.

The Screens: Recipe

Not much to report here. I added the grids to the form to make data entry easier and at the bottom I added a multi-line text box to store the instructions.

The Screens: Ingredients

The complication here is I did not need the default text attribute. To get around this I added a new section, made it hidden by default, made the default field non-compulsory and set up a workflow to populate it when the record is created or when the Measure or Food Item fields change.

“To Serve” marks if the ingredient is a garnish or not a key component of the recipe.

The Screens: Food Items and Equipment

Again, simple stuff.

Reporting

One thing, which is always a hassle when putting together recipes is the shopping. Thanks to the Reporting Wizard, I can now select the recipes I am cooking for the week and generate a list of ingredients to check against the pantry and work out what I need.

I added in the Serves column because different recipes serve different numbers of people. I could have scaled the recipes to a common unit or split out the numerical component of the Measure field and done something clever by feeding it the number of people I am cooking for and scaling the values with code but this requires effort so I have left it as an exercise for the keen. For now, to use as a list to check what I need, it does the job.

Using Mobile Express, I can also access all of my recipes on my IFD-enabled or Online version of CRM anywhere. Very useful for clarifying whether a recipe needed dried or fresh herbs, for example.

Other Ideas

Other things I have thought of but not implemented are:

• Adding Calorie information to the Food Items (and then bringing this down to the Ingredients and rolling it up to the Recipe to get the total Calories in the meal)
• Linking Food Items to each other to record substitutes (or possibly using Connections)
• Adding matching wines to the recipes
• Incorporating Food Pairing to create completely new recipes

Using CRM For Socialisation

While this and the two games I previously put together are a bit of fun, there is a way you could use this for business in fostering a collaborative culture. The recipe configurations could easily be incorporated into a production CRM system. Why would you do this? To bring people together. A recipe database is something people can contribute to for the fun of it and give them an opportunity to discuss cooking tips in the office.

The rule could be all new starters must add a recipe to CRM. This gives them an opportunity to learn the system as well as letting others in the team know a little bit about them. Maybe it could form the basis of an office cook-off.

Alternatively, perhaps your team are keen gamers or movie buffs. If so, why not add a review section to the CRM system. Maybe you want to add a swap-meet section so people can sell old items through the corporate CRM system and deliver them through internal mail in the name of bringing people together.

Conclusions

The Dynamics CRM platform is very flexible and allows us to store organised information for practically any purpose with little, if any, coding. While a recipe database may not the obvious choice for an enterprise CRM system, it is easy to implement and provides a reason for people to come together through something other than the daily grind. However, if recipes are not your thing, try something else. The only limit is your imagination and the courage to do something different for the greater good.