Field level Security in Dynamics CRM 2011

Paul Nieuwelaar, 03 November 2010

In Microsoft Dynamics CRM 2011 it is possible to set field level security on new fields, or existing fields that you have created. Unfortunately, at this time CRM 2011 doesn't support setting security on default fields, but hopefully with the full release of Dynamics CRM 2011 this will change.

To set a field to be ‘Security Enabled’, you must first open up the custom field that you want to set the security on, or create a new field. With the field window open, you will notice an option called “Field Security”, which is ‘Disabled’ by default.

If you set this to be ‘Enabled’, and then save the field, when you add it to the form, you notice a key appear next to the field name when editing the form. This indicates that the field has Field Security enabled.

Now we need to assign users or teams to this field, to allow certain users different access to the field. To do this, navigate to the new area located under Settings, Administration, called Field Security Profiles. You will notice the profile called ‘System Administrator’, which by default will add all users with the System Administrator security role, and will give full permissions to all secured fields. This profile will update automatically when a user is added or removed from the System Administrator security role, and so you do not need to update it manually.

We can create a new Field Security Profile, and then on the left navigation of the Field Security Profile, you can click on ‘Users’, where you can add and remove users that will be affected by this Field Security Profile.

Once you have added users or teams to the Field Security Profile, you can click ‘Field Permissions’ on the left navigation, where you can set the permissions of all the fields with Security Enabled, by selecting the field whose permissions you want to change and clicking edit.

A window will pop up to give you options for setting security on that field. As you can see below you can set the permissions to:
Read, which means that users can only view the field, and it will appear disabled.
Update, which means users can change the information in the field.
Create, which means users can add information to the field when the record is created.
Or any combination of the three.

By setting the permissions to only Read, when I view the Account form, I will be able to view the contents of the Bank Account No. field, but it will appear disabled, and I will not be able to change the contents.