How to configure security in Microsoft Project Online

Security and Permissions in Project Web App

Permissions are what allow users to perform a specific function or action with Project Online. The security configuration uses Allow and Deny or no selection to configure each and every permission in Project Online.
For example, the View Project Center permission may be allowed or denied for a given user or group in the system.
To provide more detail, there are two types of permissions in Project Online
• Global Permissions: These are permissions that are granted or denied that provide the ability to perform actions throughout the entire Project Online system, agnostic to a resource or project.
• Category Permissions: There are permission that are granted or denied that provide the ability to perform actions on specify resources and/or projects. Category permission are assigned at the category level. More in this later.

To make Project Online security more complex, permission may actually be set in a number of different places with the Project Web App system. Permissions are allowed or denied by selecting the checkbox in the Allow/Deny columns. There are MANY permissions to consider and set. If neither box is selected, the default state is Not Allow. The Not Allow selection does not prevent a user or users from accessing a specific feature of they are granted the permission in some other way.

For example, the user may belong to two security groups ( Project Managers and Resource Managers). Although the permissions in the Resource Managers group will have Not Selected for opening and editing projects, the Project Managers group will have it set to Allow. It is always best to leave a permission at No Allow (no checkbox selected) than to select Deny. In the scenario just noted, of the Resource Managers group had the Open and Edit project permission set to Deny, the user that was a member of both groups would ultimately not be able to manage projects as a Project Manage because the Resource Managers group specifically Denies that ability!
Permissions are configured by choosing Project Web App Settings from the Project Web App Settings menu.

Again, It is important to consider when you are configuring a permission to Deny that the Deny setting supersedes any Allow settings that apply to the user for that permission by means of other group memberships. Limit your use of the Deny setting to simplify permissions management for large groups of users.

For organizations that have a large number of users, assigning and administering permissions on an individual basis can be an overwhelming task. In these cases. Well Actually, in most every case it is best to use and assign permission at the group level. And only at the group level. This will make assigning and troubleshooting permissions much more direct. Imagine trying to troubleshoot a permission for a specific user in a Project Online environment where permissions have been assigned at both the user and group level!

Groups in Project Web App
Groups contain sets of users who have the same functionality needs. For example, project managers within your organization may need the same set of Project Online permissions, while executives or resource managers might have different needs.

Note: Group membership consists of users only. Groups cannot contain other groups.

Users can belong to multiple groups. The following default groups are available in each instance of Project Web App that is in Project Server permission mode. Each is assigned a set of predefined categories and permissions.

Categories
Categories are collections of projects, resources, and views. Categories define the scope of the information accessible to a given user or group. Again, it is highly recommended to only assign categories and apply permission at the group level. This provides an easily maintained system
Each Project Web App instance includes the following default categories:

Of course you may create as many categories as is needed to provide the correct access.

https://integent.com