Changes to asset Admin permissions and new Plan Asset Admin role, now generally available!

MHalvey

https://community.smartsheet.com/discussion/comment/428014#Comment_428014

I couldn't agree more with @Julie Fortney. We have already had a handful of Directors or VP emailing myself along with someone who manages a sheet asking if they should be granted access when I, as our Smartsheet Admin and my only job, am already working to review the request. Because I work in the financial world, we need to triple check user access and which has caused hours wasted typing emails, checking, doing due diligence to ensure this external contact should have access to this item. To this new system, there is also no "User Access is already granted or denied" pop up for the other Admins who receive this alert if it already went through. This should be applied immediately.

Thankfully I got various security enhancements enabled, including Safe Sharing Policies this year to stop phishing user access requests however even the Safe Sharing Policy popup, when trying to share properly, doesn't have the form link we applied in the Admin center to direct users to fill out a form request for a domain/user not on our lists. It's a known bug and needs to be fixed.

I'm honestly not sure if this change is more helpful or hurtful than the old system. If Owner title is going away with assets, how are other applications being handled? Will Workspaces not have an owner anymore? Dynamic Views, DataTables, Data Shuttles, Calendars, DataMesh, Pivot, WorkApps, Control Center? Will those be plan base vs user based owned in the near future? Will User Access Requests for those follow this new system as well? This opens a lot of doors of confusion and I really hope it was thought through.

Apologies for the soapbox, I'll step off it now. Thank you for reading/listening to my concerns. I know what I'm asking and saying might be harsh but I hope it shows how much I care about this software. I truly appreciate all the hard work the teams are doing. As my signature states, "Strive for Progress, not Perfection," and I think we are doing that.

Michael

Sherry Fox

"Updating the Access Request notification flow to"

This is the part that I am interested in. I was not able to find any information on how or where to make these changes. It is likely that these changes will need to be per sheet/workspace.

ker9

@QuanT - Do EXTERNAL UNLICENSED ADMIN receive sharing requests?

ETA: I received confirmation from Smartsheet that they do receive the sharing requests.

Marlana K.

@ker9 Great question I would like to know this answer as well. We are currently under a security audit and I am trying to lock our account down "tight". This week has been a nightmare with Safe Sharing, Published Items, Sheet Access reviews. The new user type report has been useful. The Sheet Access report is not very user friendly, it is hard to decipher, and due to row limit in SS I cannot upload since it has nearly 100,000 rows. I have to use Excel and create a Pivot Table.

Also there is no way to pull any kind of automated workflow report to see what is being sent outside of our approved domain using unrestricted setting.

I would love to see an Automated Workflow report that contains

Sheet Name, Workflow Name, Workflow ID, Automation Permission, Send to Contacts and if it includes the link to the sheet and/or sheet fields.

I will be entering a feature request for this!

MHalvey

https://community.smartsheet.com/discussion/comment/429112#Comment_429112

@ker9 in my testing of licensed, non-licensed in my organization and External Contacts (not on my approved domain list and just shared with assets in a various way that could be licensed or non-licensed on their organizational accounts). All users at an Admin level in an asset receives sharing request emails.

They could be shared by asset level, workspace level or by shared user groups on asset/workspace level. All sharing combinations and user account levels received sharing requests if they were Admin permissions.

There is also nothing in the UI showing if the request was approved or denied as well. All users who receive the sharing request see the same interface and can change that requesters access from it even if someone already approved at a different level. I should also be a deny button on that sharing request window.

-Michael

Stu Benoff

@Marlana K. Great information! I often wonder if Smartsheet understands just how difficult it is to manage this product. With the items you mention plus things like My Smartsheet Contacts and Editor - can share permissions its pretty hard to keep track of who has access to what. I've asked them to make the sheet access report available to all licensed users so that they can run it to see where/who has been granted access to their objects. As a System Admin with, as you said, over 100,000 rows in the system wide sheet access report its nearly impossible to do at the central level.

MHalvey

@Marlana K. - "The Sheet Access report is not very user friendly, it is hard to decipher, and due to row limit in SS I cannot upload since it has nearly 100,000 rows. I have to use Excel and create a Pivot Table."

A great trick I use to bring our rows in is combining all the Admin center excel reports into 1 excel. I have a column in the Sheet Access tab in excel that I manually drag down assigning a row number to. I then use Data Shuttle with filter to look for those numbers 1-19000, 19001-39000 per sheet and I'm able to get all our rows back into Smartsheet to run reports and metrics off. The initial setup was great but it runs wonderfully now after running this each month for almost 2 years.

I can't take credit for this trick as I learned it on a webinar a few years ago. But it's worked great for my monthly audit I run and I'm able to show dashboard information on all domains, workspaces, users and account level information to my leadership team or if a coworker needs to see user access by X domain, I can share the dashboard for that domain and other various metrics.

Hope that helps with that! 😁

-Michael

Marlana K.

@Stu Benoff As our SS SME and Primary Administrator I want MORE Visibility into our account. I had an intense conversation at Engage on this ability. I also want the ability to TURN off approval by admins. Honestly I don't want individuals having anyone assigned above editor-cannot share access this protects us a bit more.

Stu Benoff

@MHalvey Nice trick and my point is, and maybe others, is that Smartsheet should provide these tools to administer their product. We shouldn't need "tricks" to do it.

Marlana K.

@MHalvey That is great if you have data shuttle! Unfortunately something we don't have at this time.

MHalvey

@Stu Benoff - I completely understand. To manage the account including access, tricks should not be needed.

@Marlana K. - There should be a way to review/import Admin level data back into the system. I like the way Plan Usage/Insights works when you hit Create User Report and the report opens as a Smartsheet sheet for you instead of downloading it. Maybe that's something they could apply to these reports.

-Michael

Marlana K.

@Stu Benoff @MHalvey if they would increase the limits (rows, columns, cells) that would even help. Thought I saw it was supposed to happen sometime this year or I dreamed it. 😉

Stu Benoff

@Marlana K. I heard that at Engage last year too so hopefully soon. That would definitely help load the report data into a Smartsheet to work with it. Again, though, auditing should be something that Smartsheet provides.

ker9

I received confirmation from Smartsheet that External Unlicensed Admin DO receive sharing requests.

As far as the Sheet Access report is concerned, I use PowerBI or Alteryx.

We have 7,489,906 rows in that report, far surpassing anything Smartsheet or Excel could handle.

Marlana K.

@Stu Benoff Once I get the account auditing done and locked down we should be good. I inherited this mess last year and really had not had a lot of time to focus on much more than license provisioning and safe sharing that was handed off. Now that I have a team member that has joined me in both Administering the account and Solutioning, I have been able to turn my focus to clean up the account that the previous Admin/SMEs didn't have time to take care of either.