Using Protected Baselines

I received an interesting question from one of our new clients recently, and I thought you might be interested in the answer. The client wanted to know how to prevent project managers from saving a baseline in their projects, and to restrict all baseline operations to only those who are staff in the Project Management Office (PMO). The answer to this question involves two steps:

1. Create a custom security group for staff in the PMO that will allow them to save a baseline in every enterprise project.

2. Change the default settings in the Project Managers security group to prevent them from saving a Protected Baseline.

Before I demonstrate how to perform these steps, let me explain how the Microsoft PPM solutions, Project Online and Project Server, control who can save a baseline in enterprise projects. There are two types of baselines in the system: “Protected Baselines” and “Unprotected Baselines.” The Microsoft PPM solution designates Baselines 0 through 5 as Protected Baselines and Baselines 6 through 10 as Unprotected Baselines.

Using security permissions, it is possible to “lock down” both Protected and Unprotected Baselines to prevent project managers from saving a baseline in their projects. Some organizations choose to allow their project managers to use Baselines 6 through 10 for personal use, while other organizations won’t allow their project managers to save a baseline in any of the Baseline fields.

Creating a Custom Security Group for the PMO

To create a custom security group that will allow staff in the PMO to save a Protected Baseline in all enterprise projects, the Microsoft PPM application administrator should complete the following steps:

1. Log into Project Web App (PWA) with administrator permissions.

2. Click the Settings menu button (it looks like a gear wheel) in the upper right corner of the Home page and select the PWA Settings item on the menu.

3. In the Security section of the PWA Settings page, click the Manage Groups link, as shown in Figure 1.

Figure 1: Manage Groups link

4. At the top of the Manage Groups page, click the New Group button, as shown in Figure 2.

Figure 2: Manage Groups page

5. On the Add or Edit Group page, enter a name for the new security group in the Name field, enter a description in the Description field, and then optionally enter an Active Directory group name in the Active Directory Group field (only if you want to use AD sync to manage the members of this group).

6. In the Users section of the page, add the names of the members of this new security group to the Selected Users list on the right side of the page, as shown in Figure 3.

Figure 3: Add users to the new group

7. In the Categories section of the page, add the My Organization category to the Selected Categories list on the right side of the page, as shown in Figure 4. Adding this category to the new group will give staff in the PMO access to every enterprise project.

Figure 4: Select the My Organization category

8. With the My Organization category still selected in the Selected Categories list, scroll to the bottom of the Permissions for My Organization data grid.

9. At the bottom of the data grid, click the Set permissions with Template pick list and select the Project Manager item on the list, as shown in Figure 5.

Figure 5: Apply the Project Manager template

10. Click the Apply button to the right of the Set permissions with Template pick list.

Project Web App will apply the default permissions using the Project Manager template and display these permissions in the Permissions for My Organization data grid. Figure 6 shows the default permissions in the Projects section of the data grid. Notice that the Save Protected Baseline permission is set to Allowed (the Allow checkbox is selected for this permission).

Figure 6: Save Protected Baseline set to Allowed

11. Scroll down the page to the bottom of the Global Permissions data grid.

12. At the bottom of the Global Permissions data grid, click the Set permissions with Template pick list and select the Project Manager item on the list.

13. Click the Apply button to the right of the Set permissions with Template pick list, as shown in Figure 7.

Figure 7: Apply the Project Manager template

Project Web App will apply the default global permissions using the Project Manager template and will display these permissions in the Global Permissions data grid. Figure 8 shows the default permissions in the Project section of the data grid. Notice that the Save Unprotected Baseline permission is set to Allowed (the Allow checkbox is selected for this permission).

Figure 8: Save Protected Baseline set to Allowed

14. Click the Save button to save the new custom security group.

Change the Settings for the Project Managers Security Group

Warning: The content in this topical section of this blog post assumes that you haven’t changed the default permissions in the Project Managers security group.

After creating the new custom security group that will allow staff in the PMO to work with baselines in all enterprise projects, you must also change the default permissions for the Project Managers security group to prevent them from saving a Protected Baseline. To change these settings, complete the following steps:

1. In the Group Name column of the Manage Groups page in PWA, click the link for the Project Managers security group to open it for editing, as shown in Figure 9.

Figure 9: Edit the Project Managers security group

2. In the Categories section of the page, select the My Projects category in the Selected Categories list, as shown in Figure 10.

Figure 10: Select the My Projects category

3. With the My Projects category still selected in the Selected Categories list, deselect the Allow checkbox for the Save Protected Baseline permission in the Permissions for My Projects data grid, as shown in Figure 11.

Figure 11: Deselect the Save Protected Baseline permission

Note: When you deselect the Allow checkbox for the Save Protected Baseline permission, you are setting this permission to the Not Allowed state. The Not Allowed state means that both the Allow and Deny checkboxes are deselected, which will prevent your project managers from saving a Protected Baseline in all their enterprise projects.

4. If you want to prevent your project managers from saving an Unprotected Baseline as well, scroll to the Project section of the Global Permissions grid.

5. Deselect the Allow checkbox for the Save Unprotected Baseline permission, as shown in Figure 12.

Figure 12: Deselect the Save Unprotected Baseline permission

6. Click the Save button to save the changes to the Project Managers security group.

Saving a Baseline for an Enterprise Project

After setting up security permissions for Protected Baselines and optionally for Unprotected Baselines, your PPM system is now ready to begin enforcing your organization’s baselining policies. When members of the PMO open and check out any enterprise project, the system will allow them to save, update and even delete baselines in any of the 11 sets of Baseline fields.

When project managers open and check out an enterprise project, however, the system will prevent them from making any changes to Protected Baselines, and optionally to Unprotected Baselines as well. For example, when your project managers attempt to save a baseline, they will see a warning dialog like the ones shown in Figures 13 and 14.

Figure 13: Unable to save a Protected Baseline

Figure 14: Unable to save an Unprotected Baseline

There you have it — the kind of control you may want to preserve the baselines of your projects.

A version of this article originally appeared on the Sensei Project Solutions blog here.

Have questions on this article? Post them to author Dale Howard in the comments below.

Image Source