Permission Change when adding a team based on a folder

[lshannonEQEBT]

I am having an issue with permissions when adding a team. I have folders already set up with permissions for all of the roles within BIM 360 that we use. When I go to add a team, and select the "If you have already created folders to represent teams, you can select them here." option, it changes all of the original folder permissions to almost full control and then sets all members of the new team to "Create" for their permissions. I would figure that the original folder permissions would remain and be transposed to the newly created team, not just have them all reset to a higher permission level. Any thoughts as to what is causing this, or if there is someway to have a work around?

Basically I am making a template project with folders already created with permission to save time moving forward, so if BIM 360 resets all of the permissions I have already done, it is not worth it. Thank you.

[jens.krause]

Hi @lshannonEQEBT :

When creating a new Design Collaboration team, BIM 360 creates the necessary folders and sets the necessary permissions for all Team Members automatically. This function is supposed to help project admins by making it much easier to set up the team environment with permissions that allow a frictionless experience in the Design Collaboration workflows.

Please note that it is not recommended to manually change the individual folder permissions for teams folders (also Shared and Consumed folder). Please use the Design Collaboration team member permissions instead:

BIM 360 Design Collaboration: Manage Teams and Members

Please also note that BIM 360 assumes that the teams folder is a "high trust" environment for the team members, while sharing and consuming files from other teams can be done in a very "controlled" way (if necessary). 
If you provide more detailed information, "why" and "how" specific team members need to have restricted permissions, we can maybe discuss if there are better ways to handle this setup.

Kind regards,

[lshannonEQEBT]

@jens.krause Thank you for your detailed response.

Basically, I am trying to make a template where my project managers don't need to do much to get all of the permissions and preferences figured out at the beginning of the project.

I think I have figured out what I am going to do. I am planning on creating a template project with all of the folders that they will need for teams already created, including all of the permissions for the roles that would use those folders individually. More time on my part now, but hopefully it will be faster for them later. Once they have the project handed over to them, they can create teams by picking the folders and using the permissions and roles already assigned to them.

Thoughts on this? Is there an easier way to do this, or do I have any crazy pitfalls that I haven't thought of yet? Thank you for your help.

[jens.krause]

Hi @lshannonEQEBT .

Thank you for your response. I understand that it is important for you to determine the permissions for your roles and members very individually. But it is also important to understand that the Design Collaboration team workflows require specific permission levels for the team members that are controlled by BIM 360 itself through the permission levels in the teams setup. (These permissions are automatically "pushed" to the teams folders)

Can you please explain why you need to change the permissions for specific roles or members who have access to a teams folder and why this is important for your workflows? If I get a better understanding of what you want to achieve it will be easier for me to make recommendations...

I am looking forward to your reply.

Kind regards,

[lshannonEQEBT]

@jens.krause I am really just looking to streamline the process for my project managers so they don’t need to add roles manually and only need to change permissions for special circumstances. We have many teams that are not using BIM 360 for their projects, and I feel that showing how easy it is to set it all up at the beginning and going forward would be helpful to convert many of the project managers over to using it. We are working on standardizing everything so team members can flow between projects if needed and I figured that having the same “layout” for permissions, folders and teams would be helpful. It would be nice that when we add an outside consultant, as long as they have the correct role, their permissions to all of the folders and teams would already be determined.

Honestly, I am trying to find a work-around for not having template teams for new projects. Is there another way to do this? Or am I just totally lost?

Thank you for your help!

[jens.krause]

Hi @lshannonEQEBT .

I am not sure if both of us have the same understanding what a "Team" is:

A "Team" in the sense of Design Collaboration is a selection of project members who are collaborating on the same part(s)  of an aggregated model, and who have  therefore permission to edit the Cloud Workshared models in their Team folder. By design, these members of a specific Team A do NOT have permissions to edit files from another Team B, even if they have been shared to the "Shared" folder or consumed to the "Consumed" folder. These files can only be linked into the proprietary models of Team A. 

Because you can easily break the whole "Share" and "Consume" workflows by manipulating the permissions of individual team members, BIM 360 automatically controls the permission levels of the Teams folder as well as the Shared and Consumed folders.

Please let me know why and in which way you want to change these permissions. If you want to discuss your specific setup individually in a remote session, you can also log a support ticket or write me a personal message (PM).

I am looking forward to your reply.

[lshannonEQEBT]

@jens.krause Thank you for your reply.

I do understand what a Team is, I think I'm just making this more complicated than it needs to be to try and remove the workflow of adding roles to a Team manually. I noticed that if I have permissions already created for each role in every folder not associated with a Team, and then create a Team based on that folder, every one of those roles that is set to a View-Download permission  gets a Create permission for the Team folder. I was hoping that they would only get a View permission for the Team folder instead, as to "bake in" a template set of permissions for each role. The thought behind this is to already have each role set up beforehand on the generic folder, without needing to add anyone to a Team manually once it is created. I had thought that if I were to add consultant permissions to the generic folders, then once a Team is made from these folders, those consultants would all already be added the Team with the same, limited permissions. Does this make sense? I think I may be to the point of not trying to make this more user friendly and just telling my Project Admins that they will have to manually set up their Teams.

[jens.krause · Accepted solution]

 Hi @lshannonEQEBT .

Thank you for your explanation. I have understood your setup now and I tested the workflow that you use.  I can confirm that the automatic Team setup process pushes the same permissions to all folder users, regardless if they are based on an individual user or a role.

I am not sure if it is very common to add consultants to the WIP "live" model. Potentially, this is the reason why no other users have come up with this issue, yet.

Anyways, the reported behavior of the automated Teams setup process is intended, and I have found no way to bypass this in any way. So currently, the only way to achieve the desired permission levels is to either add the Consultant role to the Teams folder after the creation manually, or to correct the folder permissions after they have been pushed to the folder through the Team setup.

Just as a side note, you could also consider using a different folder for the consultants to give the Design Teams more control over what they share with them. These folders could either be populated automatically through a Review/ Approval process or by setting up a consultant Team to use the Share and Consume workflow.

You might also consider to log a Feature Request on the BIM 360 Idea Station for the facilitated setup process you want to use:

Autodesk Community I BIM 360 Ideas

Other users would then be able to support your idea with a vote. The top voted ideas are taken into account for future product updates by our development team.

I hope this information is helpful!

Kind regards,

[lshannonEQEBT]

@jens.krause Thank you again for your detailed responses! I'm glad I was finally able to communicate clearly what my thinking has been. It's tough to learn the platform and then also try to explain some abstract thinking with it! 

I think that I will just change our workflow to include our project managers setting up their teams manually. This way there are no unintended permissions, and I'm not stuck doing work-arounds. I appreciate your help!

[Sean_Page]

I know this thread is a little bit old, but I just had a very similar experience. I have a high trust environment with separate folders for each discipline to have their models contained. I have the entire structure set up with mostly View-Download permissions by User Roles. We then added an additional consultant to the team and when I added that "Aquatics" folder to the mix, EVERY other folder that uses the same Roles was set to View-Download-Upload-Edit, EVERY SINGLE ONE of them. This is exceptionally irritating after the amount of work we have done to get permissions and roles set correctly for our use, to then be completely overridden without any warning confirmation. This should be something where NO other folders need to be touched when adding additional teams.

[Rachel.StotlerGXM67]

I'm having a similar issue and wasn't able to pinpoint it until finding this thread. We are a multidiscipline firm, and I have project templates set up with appropriate permissions by role for each discipline's folder. It seems that upon initiating the Design Collaboration environment and creating "teams" so that I can auto-publish the models weekly, the Document Management folder permissions all change automatically to "View-Download-Upload-Edit" for every role. This is really unfortunate, because I have to go back and manually reset all the role permissions for each folder.