KB483069: How to provide project access to certain users/groups and deny it to others and vice versa in MicroStrategy

CONTENT:
When configuring a Strategy environment, the administrator may need to provide project access to a certain user/group at the same time that other users/groups shouldn’t. This is seen for example when a group should have ‘Web Reporter’ privilege in project A and another one should have ‘Web Professional’ in project B, considering that any other access permission should be denied.
The procedure below applies the idea of using Security Roles in three parts, where the privileges and groups can be properly separate and assigned:
Part 1 – Security roles creation

1. In Developer, go to Project Source -> Configuration Managers -> Security Roles
2. Create a new security role for a certain task/group relationship
3. In the Privileges tab, enable the desired privileges for the security role
4. In the Members tab, choose the project and add the desired group to the box on the right
5. Click OK
6. Repeat the steps for each task/group relationship

Thus, it’s possible to create a security role for each project according to the task type.
Part 2 – ‘Normal Users’ security role settings

1. In Developer, go to Project Source -> Configuration Managers -> Security Roles
2. Double click ‘Normal Users’ security role
3. In the Members tab, choose the project in which the group should have limited privileges
4. Remove the group ‘Everyone’ from the selected members in box on the right
5. Repeat the steps for each project in which the group should have limited privileges

The steps above will not allow the user/group to inherit undesired privileges from the group ‘Everyone’.
Part 3 – Enablement of security roles for user groups

1. In Developer, go to the access configuration window of the desired group
2. On the row ‘Security Role Selection’, keep the field blank for projects which the group should not have access to
3. On the same row, select the desired security role according to the desired project
4. Disable the privileges directly applied to the group, making only security roles to work
5. Repeat the steps for each group to be configured

Notice that the check marks get green instead of blue. If they’re blue, they are actually inheriting privileges from a group, or the administrator has manually assigned them. The result should be similar to the one below:

KB483069