Project Server Permission Mode Vs SharePoint Permission Mode

Manage project server permission mode

In this article, we will discuss the main differences between SharePoint Permission Mode and Project Server Permission Mode in Project Server 2016 and 2019.

Also, we’ll learn how to change Project Permission Mode to SharePoint Permission Mode using PowerShell and what’s the effect of switching between Permission Modes in Project Server.

Table of Contents

You might also like to read how to Install and Configure Project Server 2016 step by step.


Permission Modes in Project Server

In Project Server 2019 and 2016 as well as 2013, there are two security modes for controlling the user’s access to projects, project sites, and Project Server functionality which defined as the following:

  1. SharePoint Permission Mode (The default permission mode).
  2. Project Server Permission Mode.

Actually, you can’t use both Permission Modes (SharePoint Permission Mode and Project Permission Mode) as a Mix Permission Mode for the same PWA instance. Only one permission mode can be applied and used, either SharePoint Permission Mode or Project Permission Mode.

Also, If you have multiple PWA instances on the same Project Server environment, you can use a different Permission Mode for each PWA instance.

Example:

Consider, you have two PWA instances as below:

  • domain/PWA1
  • domain/PWA2

So you can use SharePoint Permission Mode for PWA1 instance as well as you can use Project Server Permission Mode for PWA2 instance! but you can’t use both Permission Modes for the same PWA instance!


Project Permission Mode Vs SharePoint Permission Mode

In this section, we’ll explore the main differences between Project Server Permission Mode and SharePoint Permission Mode, and when we should use each Permission mode in our Project Server environment.

What’s Project Server Permission Mode?

Project Server Permission Mode is a customizable and flexible permission mode that enables you to set permissions of users to Project Server objects by managing users, groups, and categories.

Project Server Permission Mode is the same security mode that was available in Project Server 2010 and Project Server 2013.

Why should you use Project Server Permission Mode?

You should use the Project Server Permission Mode if you have a complex security matrix that requires you to have full control to be able to customize and manage user permissions as well as to provide different levels of access to Projects, Project sites, and Project Server functionality as per your business requirements.

In Project Permission Mode, you have the flexibility to do the following:

  • You can fully customize the groups, categories, security templates settings ..etc.
Manage Security Permissions in Project Server
Manage Security Settings
  • You can also create additional groups and categories.
Manage Categories in Project Server
Manage Categories
  • The user delegation feature is available.
Manage Delegation in Project Server
Manage Delegation
  • Also, the Impersonation feature (Act As Delegation) is available.
Act as delegation in Project Server
Act As Delegation
  • There is (Resource Breakdown Structure) RBS filtering.
RBS in Project Server
Resource Breakdown Structure

Project Server Permission Mode Recommendations

Although Project Server Permission Mode provides you more flexibility to customize your permissions based on your business needs, it may be complex to trace the assigned permission for a specific user or group. Therefore, it’s strongly recommended to avoid the following:

  • Do not associate a user to a category directly.
    • The user should be added to a specific group.
    • The category should be associated with a group.
Set security categories to group
Security Categories
  • Do not define or set Global Permissions to a user.
    • The global permission should be defined and set in the group.
Define Global permissions to user
Global Permissions
  • In case of you don’t check Allow permission, leave Deny checkbox blank.
Allow and Deny permissions in Project Server
Allow or Deny Permissions

Default Security Groups in Project Server Permission Mode

By default, Project Server Permission Mode creates seven default groups to can control the user access and permission in a flexible manner for Project server.

Default Security Groups in Project Server Permission Mode
Default Security Groups in Project Server Permission Mode

These default groups have defined global permissions (58 Permissions) to allow user to access and use Project Server features and functionality.

(1) Administrator Group

In the Administrator Group, the users have all global permissions as well as category permissions through the “My Organization” category. This allows them to complete access to everything in Project Web App.

(2) Portfolio Managers

In the Portfolio Managers group, the users have permissions to create and manage projects. This group is intended for project owners who assign tasks to resources.

(3) Portfolio Viewers

In the Portfolio Viewers group, the users have permissions to view the Project and Project Web App data. This group is intended for high-level users who need visibility into projects but are not themselves assigned project tasks.

(4) Project Managers

In the Project Managers group, the users have permissions to create and manage projects. This group is intended for project owners who assign tasks to resources.

(5) Resource Managers

In the Resource Managers group, the users have the most global and category-level resource permissions. This group is intended for users who manage and assign resources and edit resource data.

(6) Team Leads

In the Team Leads group, the users have limited permissions around task creation and status reports. This group is intended for persons in a lead capacity that do not have regular assignments on a project.

(7) Team Members

In the Team Members group, the users have general permissions for using Project Web App, but limited project-level permissions. This group is intended to give everyone basic access to Project Web App.

Read more about Default Security Groups at Default Group Permissions in Project Server.

Default Categories in Project Server Permission Mode

By default, Project Server Permission Mode creates five security categories that are associated with default security groups to provide a different set of category permissions (22 permissions) for each security group to perform certain tasks with projects and resources.

Manage Categories in Project Server
Manage Categories in Project Server

Read more about Default Categories at Default Categories Permissions in Project Server.


What’s SharePoint Permission Mode?

SharePoint Permission Mode is the default permission mode in Project Server.

SharePoint Permission Mode in Project Server
  • It is a special set of SharePoint security groups that used to provide users different levels of access to Projects, Project sites, and Project Server functionality.
  • It was not available in Project Server 2010 and introduced in Project Server 2013 and still used with Project Server 2016, Project Server 2019, and Project Online.
  • It is simple but not flexible to match the most complex business requirements.

SharePoint Permission Mode Limitations

  • You can’t edit the default permissions assigned to any of these SharePoint groups.
  • You can’t create additional custom groups.
  • You can’t create additional custom categories.
  • You can’t view global permissions and other security settings.
  • There is no (Resource Breakdown Structure) RBS filtering.
  • The user delegation feature is not available.
  • Impersonation is not available.
Missing Security Section in Project Server
Missing Security Settings

You might be also interested to read

Default Security Groups in SharePoint Permission Mode

By default, SharePoint Permission Mode creates seven default SharePoint groups that directly correspond to the default security groups in Project Server Permission Mode.

SharePoint Permission Mode Project Server 2013/2016
Project Site SharePoint Permission Mode

Permissions to projects sites and resources are granted by associating the user to one of the 3 predefined groups, which are created automatically per project site:

  • Visitors: reflects read-only privileges.
  • Members: reflects Team Member privileges.
  • Owners: reflects Project Manager privileges.
Project Site SharePoint Permission Mode

In SharePoint Permission Mode, SharePoint groups have the same global and category permissions that are assigned to them in Project Server permission mode.


Global Permission Vs Category Permission in Project Server

In Project Server 2019, 2016 as well as 2013, the user have two different types of permissions:

  1. Global Permissions (Allow users to use and access sites and features).
  2. Category Permissions (Allow users to do tasks with projects, resources, and views).

What’s Global Permission in Project Server?

Project Server Global Permission allows or deny users to access PWA instance and use its features. it’s only available in Project Server Permission Mode.

Project Server Global Permissions
Project Server Global Permissions

Note: Don’t set the global permission to a user directly. instead, you should set it to a group.

Project Server Global Permission divided to 8 sections with 58 permissions as the following:

  1. Admin (19 Permissions)
    1. Change Workflow.
    2. Clean Up Project Server Database.
    3. Manage Active Directory Settings.
    4. Manage Check-Ins.
    5. Manage Cube Building Service.
    6. Manage Enterprise Calendars.
    7. Manage Enterprise Custom Fields.
    8. Manage Exchange Integration.
    9. Manage Gantt Chart and Grouping Formats.
    10. Manage Notification and Reminders.
    11. Manage Project Web App Views.
    12. Manage Queue.
    13. Manage Security.
    14. Manage Server Configuration.
    15. Manage Server Events.
    16. Manage SharePoint Foundation.
    17. Manage Users and Groups.
    18. Manage Workflow and Project Detail Pages.
    19. Save Enterprise Global.
  2. General (8 Permissions)
    1. Access Project Server Reporting Service.
    2. Contribute to Project Web App.
    3. Log On.
    4. Log on to Project Server from Project Professional.
    5. Manage Lists in Project Web App.
    6. Manage Personal Notifications.
    7. New Task Assignment.
    8. Reassign Task.
  3. Portfolio Strategy (3 Permissions)
    1. Manage Drivers.
    2. Manage Portfolio Analyses.
    3. Manage Prioritizations.
  4. Project (5 Permissions).
    1. Build Team on New Project.
    2. New Project.
    3. Open Project Template.
    4. Save Project Template.
    5. Save Unprotected Baseline.
  5. Resource (6 Permissions)
    1. Can be Delegate.
    2. Manage My Delegates.
    3. Manage My Resource Delegates.
    4. Manage Resource Notifications.
    5. New Resource.
  6. Status Reports (1 Permission)
    1. Edit Status Report Requests.
  7. Time and Task Management (7 Permissions)
    1. Manage Rules.
    2. Manage Time Reporting and Financial Periods.
    3. Manage Time Tracking.
    4. Self-assign Team Tasks.
    5. Status Broker Permission.
    6. View Project Timesheet Line.
    7. Approvals View Resource Timesheet.
  8. Views (9 Permissions)
    1. View Approvals.
    2. View Business Intelligence Link.
    3. View Project Center.
    4. View Project Schedule Views.
    5. View Resource Availability.
    6. View Resource Center.
    7. View Task Center.
    8. View Team Builder.
    9. View Timesheets.

To know more about the 58 global permissions, Please check Global permissions in Project Server.


What’s Category Permission in Project Server?

Project Server Category Permission provides the associated group a set of permissions to do certain tasks with project, resources.

Project Server Category Permissions

Note: Don’t associate a category permission to a user directly.

Project Server Global Permission divided to 2 sections with 22 permissions as the following:

  1. Project (15 Permissions)
    1. Accept Task Update Requests.
    2. Build Team On Project.
    3. Create Deliverable and Legacy Item Links.
    4. Create New Task or Assignment.
    5. Delete Project.
    6. Edit Project Summary Fields.
    7. Manage Basic Project Security.
    8. Manage Resource Plan.
    9. Open Project.
    10. Publish Project.
    11. Save Project to Project Server.
    12. Save Protected Baseline.
    13. View Project Schedule in Project Web App.
    14. View Project Site.
    15. View Project Summary in Project Center
  2. Resource (7 Permissions)
    1. Adjust Timesheet.
    2. Approve Timesheets.
    3. Assign Resource.
    4. Edit Enterprise Resource Data.
    5. Manage Resource Delegates.
    6. View Enterprise Resource Data.
    7. View Resource Assignments in Assignment Views

To know more about the 58 global permissions, Please check Category permissions in Project Server.


Change Permission Mode in Project Server

Before you decide to switch from one Permission Mode to another in Project Server or even Project Online, you should be aware of all the current activated Permission Mode configurations settings will be deleted and can’t be restored.

Switch from the default SharePoint Permission Mode to Project Server Permission Mode

As we earlier mentioned, In Project Server, the default permission mode is the SharePoint Permission Mode that can be changed for a given Project Web App instance through PowerShell by using the Set-SPProjectPermissionMode cmdlet.

Change to Project Permission Mode in Project Server 2016 and 2019

Steps
  • Open SharePoint Management Shell as Administrator.
Open SharePoint 2016 PowerShell - Upgrade and Migrate to Project Server 2016
  • Get the current Permission Mode using Get-SPProjectPermissionMode.
Get-SPPRojectPermissionMode -Url 'PWA URL'
Get Current Permission Mode in Project Server
Get Current Permission Mode in Project Server
  • Run the below cmdelt to Change SharePoint Permission Mode to Project Server Permission Mode in Project Server 2016 and 2019.
Set-SPPRojectPermissionMode -Url 'PWA URL' -Mode ProjectServer
Test Permission Mode Changes

To make sure that the SharePoint Permission Mode is switched to Project Server Permission Mode successfully, you should do the following:

  • Go to PWA Setting,
  • You would note that the security Section is shown as below.
Project Server Permission Modes In Project Server

Change to Project Permission Mode in Project Server 2013

In Project Server 2013, you should add “-AdministratorAccount” parameter as shown below:

Set-SPPRojectPermissionMode -Url 'PWA URL' -AdministratorAccount 'domain\adminaccount' -Mode ProjectServer
switch to Project Permission Modes In Project Server
Change to Project Permission Modes In Project Server 2013

Switch from Project Server Permission Mode to the SharePoint Permission Mode

You can also switch back from Project Server Permission Mode to the default SharePoint Permission Mode but you should note that all settings will be deleted and you will not be able to restore the same settings back.

Change to SharePoint Permission Mode in Project Server 2016 and 2019

Steps

  • Open SharePoint Management Shell as Administrator.
Open SharePoint 2016 PowerShell - Upgrade and Migrate to Project Server 2016
Set-SPPRojectPermissionMode -Url 'PWA URL' -Mode SharePoint
Change to SharePoint Permission Mode in Project Server 2013

In Project Server 2013, you should add “-AdministratorAccount” parameter as shown below:

Set-SPPRojectPermissionMode -Url 'PWA URL' -AdministratorAccount 'domain\adminaccount' -Mode SharePoint

Change Permission Mode in Project Online

Steps

  • Using the Admin Account, Go to SharePoint Admin Center.
  • Below Site collection with Project Web App (PWA), check your PWA instance URL.
  • From the above ribbon, Click on Project Web App > Settings.
  • Check the preferred Permission Mode as per your needs.
Change permission management in Project Online
Permissions Management in Project Online

Conclusion

In conclusion, we have learned the following:

  • What’re the main differences between SharePoint Permission Mode and Project Server Permission mode?
  • Global Permissions Vs Category Permissions.
  • How to change Project Permission Mode in Project Server and Project Online?
Applies to
  • SharePoint 2019.
  • SharePoint 2016.
  • SharePoint 2013.
  • Project Online.
You might also like to read
Have a Question?

If you have any related questions, please don’t hesitate to ask it at deBUG.to Community.

7 thoughts on “Project Server Permission Mode Vs SharePoint Permission Mode”

  1. Thanks for the tip! I was in the Project Server mode, and i thought i was in the Sharepoint. Gone to the PWA Settings and solved!!!

  2. Pingback: Sorry, you don't have a license to use Project Web App In Multi-Tenant Project Server | SPGeeks

Leave a Reply