Project Server Permission Mode Vs SharePoint Permission Mode

In this article, we will discuss the main differences between SharePoint Permission Mode and Project Server Permission Mode in Project Server 2016 and 2019.

Also, we’ll learn how to change Project Permission Mode to SharePoint Permission Mode using PowerShell and what’s the effect of switching between Permission Modes in Project Server.

You might also like to read how to Install and Configure Project Server 2016 step by step.

---

Permission Modes in Project Server

In Project Server 2019 and 2016 as well as 2013, there are two security modes for controlling the user’s access to projects, project sites, and Project Server functionality which defined as the following:

1. SharePoint Permission Mode (The default permission mode).
2. Project Server Permission Mode.

Actually, you can’t use both Permission Modes (SharePoint Permission Mode and Project Permission Mode) as a Mix Permission Mode for the same PWA instance. Only one permission mode can be applied and used, either SharePoint Permission Mode or Project Permission Mode.

Also, If you have multiple PWA instances on the same Project Server environment, you can use a different Permission Mode for each PWA instance.

Example:

Consider, you have two PWA instances as below:

• domain/PWA1
• domain/PWA2

So you can use SharePoint Permission Mode for PWA1 instance as well as you can use Project Server Permission Mode for PWA2 instance! but you can’t use both Permission Modes for the same PWA instance!

---

Project Permission Mode Vs SharePoint Permission Mode

In this section, we’ll explore the main differences between Project Server Permission Mode and SharePoint Permission Mode, and when we should use each Permission mode in our Project Server environment.

Why should you use Project Server Permission Mode?

You should use the Project Server Permission Mode if you have a complex security matrix that requires you to have full control to be able to customize and manage user permissions as well as to provide different levels of access to Projects, Project sites, and Project Server functionality as per your business requirements.

In Project Permission Mode, you have the flexibility to do the following:

• You can fully customize the groups, categories, security templates settings ..etc.

• You can also create additional groups and categories.

• The user delegation feature is available.

• Also, the Impersonation feature (Act As Delegation) is available.

• There is (Resource Breakdown Structure) RBS filtering.

Project Server Permission Mode Recommendations

Although Project Server Permission Mode provides you more flexibility to customize your permissions based on your business needs, it may be complex to trace the assigned permission for a specific user or group. Therefore, it’s strongly recommended to avoid the following:

• Do not associate a user to a category directly.
  • The user should be added to a specific group.
  • The category should be associated with a group.

• Do not define or set Global Permissions to a user.
  • The global permission should be defined and set in the group.

• In case of you don’t check Allow permission, leave Deny checkbox blank.

Default Security Groups in Project Server Permission Mode

By default, Project Server Permission Mode creates seven default groups to can control the user access and permission in a flexible manner for Project server.

These default groups have defined global permissions (58 Permissions) to allow user to access and use Project Server features and functionality.

(1) Administrator Group

In the Administrator Group, the users have all global permissions as well as category permissions through the “My Organization” category. This allows them to complete access to everything in Project Web App.

(2) Portfolio Managers

In the Portfolio Managers group, the users have permissions to create and manage projects. This group is intended for project owners who assign tasks to resources.

(3) Portfolio Viewers

In the Portfolio Viewers group, the users have permissions to view the Project and Project Web App data. This group is intended for high-level users who need visibility into projects but are not themselves assigned project tasks.

(4) Project Managers

In the Project Managers group, the users have permissions to create and manage projects. This group is intended for project owners who assign tasks to resources.

(5) Resource Managers

In the Resource Managers group, the users have the most global and category-level resource permissions. This group is intended for users who manage and assign resources and edit resource data.

(6) Team Leads

In the Team Leads group, the users have limited permissions around task creation and status reports. This group is intended for persons in a lead capacity that do not have regular assignments on a project.

(7) Team Members

In the Team Members group, the users have general permissions for using Project Web App, but limited project-level permissions. This group is intended to give everyone basic access to Project Web App.

Read more about Default Security Groups at Default Group Permissions in Project Server.

Default Categories in Project Server Permission Mode

By default, Project Server Permission Mode creates five security categories that are associated with default security groups to provide a different set of category permissions (22 permissions) for each security group to perform certain tasks with projects and resources.

Read more about Default Categories at Default Categories Permissions in Project Server.

---

What’s SharePoint Permission Mode?

SharePoint Permission Mode is the default permission mode in Project Server.

• It is a special set of SharePoint security groups that used to provide users different levels of access to Projects, Project sites, and Project Server functionality.
• It was not available in Project Server 2010 and introduced in Project Server 2013 and still used with Project Server 2016, Project Server 2019, and Project Online.
• It is simple but not flexible to match the most complex business requirements.

SharePoint Permission Mode Limitations

• You can’t edit the default permissions assigned to any of these SharePoint groups.
• You can’t create additional custom groups.
• You can’t create additional custom categories.
• You can’t view global permissions and other security settings.
• There is no (Resource Breakdown Structure) RBS filtering.
• The user delegation feature is not available.
• Impersonation is not available.

You might be also interested to read

• Missing Delegation Feature in Project Server
• Missing Security Settings in Project Online
• Missing Security Section in PWA Settings

Default Security Groups in SharePoint Permission Mode

By default, SharePoint Permission Mode creates seven default SharePoint groups that directly correspond to the default security groups in Project Server Permission Mode.

Project Site SharePoint Permission Mode

Permissions to projects sites and resources are granted by associating the user to one of the 3 predefined groups, which are created automatically per project site:

• Visitors: reflects read-only privileges.
• Members: reflects Team Member privileges.
• Owners: reflects Project Manager privileges.

In SharePoint Permission Mode, SharePoint groups have the same global and category permissions that are assigned to them in Project Server permission mode.

---

Global Permission Vs Category Permission in Project Server

In Project Server 2019, 2016 as well as 2013, the user have two different types of permissions:

1. Global Permissions (Allow users to use and access sites and features).
2. Category Permissions (Allow users to do tasks with projects, resources, and views).

What’s Global Permission in Project Server?

Project Server Global Permission allows or deny users to access PWA instance and use its features. it’s only available in Project Server Permission Mode.

Note: Don’t set the global permission to a user directly. instead, you should set it to a group.

Project Server Global Permission divided to 8 sections with 58 permissions as the following:

1. Admin (19 Permissions)
   1. Change Workflow.
   2. Clean Up Project Server Database.
   3. Manage Active Directory Settings.
   4. Manage Check-Ins.
   5. Manage Cube Building Service.
   6. Manage Enterprise Calendars.
   7. Manage Enterprise Custom Fields.
   8. Manage Exchange Integration.
   9. Manage Gantt Chart and Grouping Formats.
   10. Manage Notification and Reminders.
   11. Manage Project Web App Views.
   12. Manage Queue.
   13. Manage Security.
   14. Manage Server Configuration.
   15. Manage Server Events.
   16. Manage SharePoint Foundation.
   17. Manage Users and Groups.
   18. Manage Workflow and Project Detail Pages.
   19. Save Enterprise Global.
2. General (8 Permissions)
   1. Access Project Server Reporting Service.
   2. Contribute to Project Web App.
   3. Log On.
   4. Log on to Project Server from Project Professional.
   5. Manage Lists in Project Web App.
   6. Manage Personal Notifications.
   7. New Task Assignment.
   8. Reassign Task.
3. Portfolio Strategy (3 Permissions)
   1. Manage Drivers.
   2. Manage Portfolio Analyses.
   3. Manage Prioritizations.
4. Project (5 Permissions).
   1. Build Team on New Project.
   2. New Project.
   3. Open Project Template.
   4. Save Project Template.
   5. Save Unprotected Baseline.
5. Resource (6 Permissions)
   1. Can be Delegate.
   2. Manage My Delegates.
   3. Manage My Resource Delegates.
   4. Manage Resource Notifications.
   5. New Resource.
6. Status Reports (1 Permission)
   1. Edit Status Report Requests.
7. Time and Task Management (7 Permissions)
   1. Manage Rules.
   2. Manage Time Reporting and Financial Periods.
   3. Manage Time Tracking.
   4. Self-assign Team Tasks.
   5. Status Broker Permission.
   6. View Project Timesheet Line.
   7. Approvals View Resource Timesheet.
8. Views (9 Permissions)
   1. View Approvals.
   2. View Business Intelligence Link.
   3. View Project Center.
   4. View Project Schedule Views.
   5. View Resource Availability.
   6. View Resource Center.
   7. View Task Center.
   8. View Team Builder.
   9. View Timesheets.

To know more about the 58 global permissions, Please check Global permissions in Project Server.

---

What’s Category Permission in Project Server?

Project Server Category Permission provides the associated group a set of permissions to do certain tasks with project, resources.

Note: Don’t associate a category permission to a user directly.

Project Server Global Permission divided to 2 sections with 22 permissions as the following:

1. Project (15 Permissions)
   1. Accept Task Update Requests.
   2. Build Team On Project.
   3. Create Deliverable and Legacy Item Links.
   4. Create New Task or Assignment.
   5. Delete Project.
   6. Edit Project Summary Fields.
   7. Manage Basic Project Security.
   8. Manage Resource Plan.
   9. Open Project.
   10. Publish Project.
   11. Save Project to Project Server.
   12. Save Protected Baseline.
   13. View Project Schedule in Project Web App.
   14. View Project Site.
   15. View Project Summary in Project Center
2. Resource (7 Permissions)
   1. Adjust Timesheet.
   2. Approve Timesheets.
   3. Assign Resource.
   4. Edit Enterprise Resource Data.
   5. Manage Resource Delegates.
   6. View Enterprise Resource Data.
   7. View Resource Assignments in Assignment Views

To know more about the 58 global permissions, Please check Category permissions in Project Server.

---

Change Permission Mode in Project Server

Before you decide to switch from one Permission Mode to another in Project Server or even Project Online, you should be aware of all the current activated Permission Mode configurations settings will be deleted and can’t be restored.

Switch from the default SharePoint Permission Mode to Project Server Permission Mode

As we earlier mentioned, In Project Server, the default permission mode is the SharePoint Permission Mode that can be changed for a given Project Web App instance through PowerShell by using the Set-SPProjectPermissionMode cmdlet.

Change to Project Permission Mode in Project Server 2016 and 2019

Steps

• Open SharePoint Management Shell as Administrator.

• Get the current Permission Mode using Get-SPProjectPermissionMode.

Get-SPPRojectPermissionMode -Url 'PWA URL'

• Run the below cmdelt to Change SharePoint Permission Mode to Project Server Permission Mode in Project Server 2016 and 2019.

Set-SPPRojectPermissionMode -Url 'PWA URL' -Mode ProjectServer

Test Permission Mode Changes

To make sure that the SharePoint Permission Mode is switched to Project Server Permission Mode successfully, you should do the following:

• Go to PWA Setting,
• You would note that the security Section is shown as below.

Change to Project Permission Mode in Project Server 2013

In Project Server 2013, you should add “-AdministratorAccount” parameter as shown below:

Set-SPPRojectPermissionMode -Url 'PWA URL' -AdministratorAccount 'domain\adminaccount' -Mode ProjectServer

Switch from Project Server Permission Mode to the SharePoint Permission Mode

You can also switch back from Project Server Permission Mode to the default SharePoint Permission Mode but you should note that all settings will be deleted and you will not be able to restore the same settings back.

Change to SharePoint Permission Mode in Project Server 2016 and 2019

Steps

• Open SharePoint Management Shell as Administrator.

Set-SPPRojectPermissionMode -Url 'PWA URL' -Mode SharePoint

Change to SharePoint Permission Mode in Project Server 2013

In Project Server 2013, you should add “-AdministratorAccount” parameter as shown below:

Set-SPPRojectPermissionMode -Url 'PWA URL' -AdministratorAccount 'domain\adminaccount' -Mode SharePoint

---

Change Permission Mode in Project Online

Steps

• Using the Admin Account, Go to SharePoint Admin Center.
• Below Site collection with Project Web App (PWA), check your PWA instance URL.
• From the above ribbon, Click on Project Web App > Settings.
• Check the preferred Permission Mode as per your needs.

---

Conclusion

In conclusion, we have learned the following:

• What’re the main differences between SharePoint Permission Mode and Project Server Permission mode?
• Global Permissions Vs Category Permissions.
• How to change Project Permission Mode in Project Server and Project Online?

Applies to

• SharePoint 2019.
• SharePoint 2016.
• SharePoint 2013.
• Project Online.

You might also like to read

• Install and Configure Project Server 2016 step by step.
• Migrate to Project Server 2016 Step By Step.
• Missing Alerts and Reminders Project Server 2016.
• What’s new and deprecated in Project Server 2016?

Have a Question?

If you have any related questions, please don’t hesitate to ask it at deBUG.to Community.