Security Initialization Settings

Initialization settings for WorkPoint 365 security builds upon the WorkPoint security settings, and consultants who are to configure initialization settings are expected to have an advanced understanding of WorkPoint's security engine.

When an entity is created in WorkPoint 365, the security engine will as standard be granting the person who created the entity "Contribute" permissions immediately. This ensures that the creator can access the entity without delay. This assignment will only be temporary until all security rules has been applied and been implemented to avoid a time frame where the user didn't have access at all. However, this default setting may not always be sufficient for scenarios where more control and specificity are needed.

To address the need for more controlled access to newly created entities, WorkPoint 365 offers "Initialization settings." Administrators can enable "Security Initialization," which allows you to trigger security rules targeting entities or SharePoint groups to run at the moment of entity creation. This means that, in addition to the entity creator, other relevant personnel can be granted specific permissions immediately.

The primary reason for using Initialization Settings is to provide immediate and granular access control to entities beyond the default "Contribute" permissions after the initial security is set, but before the post-entity-creation security job is run. For instance, if a Project entity requires its project manager to have "Full Control" permissions from the moment of creation, Initialization Settings can be configured to ensure this access. This feature enhances security and efficiency, allowing organizations to meet specific access requirements and maintain a higher level of control over entity security.

Before going deeply into the Security Initialization Settings, it is important to understand how initial security traditionally set when new entities are created.

When a buffer site is created, the static rules configured on the business module are applied to the entity and the underlying lists and libraries. At some point, a new entity is created on the business module. This can be done either through WorkPoint Automate, the WorkPoint API, or other actions. When the entity is created, WorkPoint's entity creation provisioning engine runs a job which performs the entity site provisioning. During this job, an available buffer site is connected to the entity. If no buffer site is available, a new site is created for the entity. As part of this provisioning job, an initial security job is run where the entity author, meaning the person who created the entity, is granted "Contribute" permissions to the site. Once the initial security job is complete the site is ready for use and users can in theory access it. Soon thereafter, another post-creation security job is run which removes the permission granted to the entity author by the initial security job, and applies all dynamic security rules configured on the business module (* if their activation conditions are met)

As previously mentioned, this traditional setup is sufficient in many cases, but in others it may be necessary to be able to finely define who gets initial access to the entity and site.

Using the security initialization settings, you can postpone the the readiness of the site by inserting a job after the initial security. This job can apply specific security rules to the entity and the SharePoint groups on the site. We refer to these security rules as High priority security rules. This approach is exemplified in the following image:

In the image above, we can see that the "High priority security rules" block is executed after the initial security has been set, and before the site is ready for users to enter. As previously mentioned, the person who created the entity is granted Contribute permissions to the site by the initial security job. By applying the high priority security rules before site readiness, it is possible to grant other personnel, e.g., a Project Manager, access to the project immediately upon entity creation instead of them having to wait until the subsequent security job applies all security rules.

As a general recommendation, the high priority security rules should be targeted at the current user, i.e., the user who created the entity or any personnel who needs immediate access to the entity upon creation.

Security Initialization Settings are only available in WorkPoint 365 version 4. Also note that using the feature requires it to be enabled on your WorkPoint License.

Additionally, this feature is included in the eXtreme premium extension package. You can read more about this package in this presentation (Source: WorkPoint Partner Portal).

Initialization settings can be configured in the "Initialization Settings" section of the Security Settings page of any business module:

To enhance security, use high priority security rules for the current user (the user creating the entity) or personnel needing immediate access. Other users can typically wait for access until the post-creation security job runs or initialization mode ends.

Use high-priority security rules sparingly to prevent delays in the post-creation security job, which can prolong the time it takes for other users to gain access to the entity.