Adding another Team to the Portal

Sandy_Wood

We currently have our IT folks using the Portal and they're all in the AD group Cireson Portal Analysts. Now we'd like to add another group of Facility folks. What's the best way to give them the same access as the Cireson Portal Analysts without seeing anyone else's Work Items?

Konstantin_Slavin-Bo

I think the only way to do that would be with queues. You would need to create and manage queues in SCSM, and make the queue dependent on some property on the WIs, e.g. Support Group or a custom property e.g. Department. That would scope the access to WIs, and make sure that only the analysts from a specific queue can see those WIs. IT could have access to all queues, so they could see everything. You would need to mind that if you use a custom property, you would need to change that property, if IT sends an IR to the Facility department. We have a custom console task for that, and it should be simple to make a similar task on the portal.

There's some important things to know about queues before you venture there, so I would suggest to read up on it first.

Peter_Settle

Basically add them as you have added the IT Folk.

But create a view which shows only the work allocated to them.

Peter_Settle

You can create a new AD group to contain the members but remember to give those members Portal Analyst access if they are going to be dealing with Work Items.

Konstantin_Slavin-Bo

They would still be able to see all WIs in the Active Work view. But if you don't mind that, you could create an AD-group of the Facility analysts, add that AD group in you Cireson Portal Analysts (which would give them Analyst access to the portal), and then use the Portal Group Mapping setting in SCSM to map the AD-groups for IT and for Facility to different Support Groups / Tier queues. This would enable the Facility analysts to use the Team Work view, and only see their own WIs, and the same goes for the IT analysts (as long as an WI is assigned to the right support group). But this would still mean, that everyone could search for any WI as well as see them in Active Work.

Sandy_Wood

I think creating a view sounds easier (for me) than queues. Appreciate the ideas!

Peter_Settle

The view is the easiest and can be done quickly.

However Long term I would agree with Konstantin you will benefit from creating a new group.

We have several as we are an ITIL compliant team.

Konstantin_Slavin-Bo

Then I would recommend this:
One AD group for Portal Analysts.
One AD group for each "team", and a tier queue / support group to match that AD group.
Add all AD groups to the Portal Analysts AD group.
In SCSM console in Administration > Settings > Cireson - Portal Group Mapping Settings, map each support group to the corresponding AD group.

This way, each team has an unique "Team Work" view on the portal, which only shows WIs assigned to their Support Group.

Sandy_Wood

Konstantin_Slavin-Bo said:

Then I would recommend this:
One AD group for Portal Analysts.
One AD group for each "team", and a tier queue / support group to match that AD group.
Add all AD groups to the Portal Analysts AD group.
In SCSM console in Administration > Settings > Cireson - Portal Group Mapping Settings, map each support group to the corresponding AD group.

This way, each team has an unique "Team Work" view on the portal, which only shows WIs assigned to their Support Group.

This sounds like the best choice - Checking my Cireson Portal Support Group Mappings, I noticed the four groups we already have are conveniently there waiting for AD group assignment. Forgot about Support Groups.

Peter_Settle

You can then create separate view for incoming items, resolved and completed etc. and target them at the groupd by using your Navigation settings.

Konstantin_Slavin-Bo

@Sandy_Wood
Yes, that's exactly what you need to set up. Team Work on the portal will then show the WIs for the groups that the logged on user is a member of.

My Work of course shows the WIs assigned to the logged on user and Active Work shows everything.

But still remember to add the Facility AD group (or users directly) to the "main" Portal Analyst group to ensure they have access to the WIs assigned to them and their support groups. 

Sandy_Wood

In the Cireson - Portal Group Mapping Settings, it says "Incidents" - will any Change Requests also abide by the same rules depending on what AD group they're in?

Geoff_Ross

Agree, views over queues will perform so much better if you can accept the security risks. Manage this with training and monitoring and you'll be fine. Regards to All Work Items, just change that view in Nav Settings to no longer show to all Analysts, instead, only your IT group and then only IT will see that. Everyone else will only see My Work and Team work.

Geoff

Peter_Settle

Anything assigned to the specific user i.e. Incidents, service requests, change requests will show up in the my work view.

Konstantin_Slavin-Bo

If needed for anything specific, you can also create a view in the SCSM console and promote that to Web. This will make this view available on the Portal, and you can then use Navigation Settings to only allow a specific AD group access to the view. 

Good thinking @Geoff_Ross, I completely forgot that about that!

Sandy_Wood

Currently I have the following settings Navigation:

Team Requests - Public
Team Work - Cireson Portal Analysts (AD Group)
Active Work - Cireson Portal Analysts (AD Group)

Sounds like I should create a Team Work and Active Work folder for each Support Group if I want to isolate what they see.

Konstantin_Slavin-Bo

Oh, and the Cireson Group Mapping has individual settings for Incident and Service Request support groups, which must be set up for each. Unfortunately nothing for Change Requests, but I guess those will be assigned to specific individuals (or AD groups) anyways, which makes it show up in My Work.

Peter_Settle

Yes Change Requests are User Specific as they are assigned to one Implementer.

Unless they have several manual activities.

Konstantin_Slavin-Bo

Sandy_Wood said:

Currently I have the following settings Navigation:

Team Requests - Public
Team Work - Cireson Portal Analysts (AD Group)
Active Work - Cireson Portal Analysts (AD Group)

Sounds like I should create a Team Work and Active Work folder for each Support Group if I want to isolate what they see.

No, not at all. The Team Work will only show work items, to those users, who are a member of the support group to which the work item is placed (through the Group Mapping). So everybody should have access to the same Team Work, but it'll show different work items to different teams. 

Team Requests are a whole other thing, which allows end users to see each others tickets. 

Konstantin_Slavin-Bo

So if an IR is placed to the Facility support group, and the support group is mapped to a Facility-analysts support group, then when a member of that AD group presses Team Work, they will only see that IR, and none of the others placed to other support groups. 

Edit: So the whole Portal Analysts group (which contains both IT and Facility folks) needs to have access to the same Team Work. 

Peter_Settle

AD groups control what team you are associated with and therefore the Team Work pool will reflect the work associated with your team.

Don't let the Portal Analyst bit confuse the situation, this is the group for work item amendment etc..

Sandy_Wood

As for Active Work, will that only show what's in the user's specific Support Group Mapping?

Konstantin_Slavin-Bo

No, Team Work does exactly that. Active Work shows all active work items assigned to all and any support groups. That's why @Geoff_Ross suggested that you in the Navigation settings make the Active Work visible to the AD group containing the IT folks only. 

Geoff_Ross

No, that shows everything, which is why you would want to lock that down to IT Analysts and not All Analysts.

Team Work shows WIs that are assigned to the Support Group(s) that the current logged on user is in.

Sandy_Wood

Got it. Thanks to you all a ton for the knowledge dump. This will help me greatly! I owe you all a beer.

Konstantin_Slavin-Bo

You're very welcome. That's the great thing about this community. Everyone is working with the same product(s), and everyone is very happy to help to one another. Don't hesitate to ask another time And provide help to another member if you can