1. Intro

This guide will explain how to configure a client on Microsoft Azure and then use the information from Microsoft Azure to configure an OAuth Provider in KiyoCRM.

2. Register KiyoCRM App in Microsoft Store

The following steps assume that you are configuring a provider for a company account that will be shared among many users.

2.1 Go to App Registrations

Go to https://portal.azure.com/ and login

On the home page you should see a screen like the following

Check if there is a link to App Registrations on the home page, should look something like the following

Otherwise, go to More services and then search for the App Registrations link

The Azure App Registrations page looks like the following

2.2 Create a New App Registration

On the App Registrations page click on the "New Registration" link

You should then see the App registration creation page

On the registration page complete the following:

After filling in the information proceed with the registration

After the registration you should be re-directed to the "detail view" of the registration.

There you will find Application (client) ID that is the Client Id that will need to be configured later on KiyoCRM.

2.3. Create a client secret 

The next step to take is to generate a "client secret" that will be used by KiyoCRM to communicate with Microsoft.

On your App Registration main page click "Add a certificate or secret".

This should take you to the "Certificates & secrets" page

Here you can generate a new secret by clicking "New Client Secret"

A sidebar should open where you can place the name of the secret you want to give to you secret and its duration. After setting the name and the duration click "Add".

This should generate a new line on the "Certificates & secrets" page table

You should copy the "Value" by (clicking the icon next to it) for your new secret and store it in some safe place. You won’t be able to access this value again from the Microsoft Azure interface. The secret will be required on the KiyoCRM documentation.

We recommend noting the expiry date for your Client Secret and replacing the secret on a regular basis. Once the secret expires, your email connections will fail with an error message in the logs similar to OAuthAuthorizationService::hasConnectionTokenExpired | Access token has expired If you see this error, generate a new secret in Azure and update it within KiyoCRM to ensure continued access.

Now go back to your App Registration main page, by clicking "Overview" on the sidebar.

2.4. Define the authorized scopes 

Our next step is to configure the scopes that KiyoCRM will be able to access.

Back on your App Registration main page

Click on "View API" permissions

This should take you to the "Api Permissions" page

Now lets add the scopes that we allow. Click "Add a permission"

This should open a sidebar

The permissions we want are under the Microsoft Graph. So click on "Microsoft Graph".

After clicking you should be prompted with which kind of permission you want to use.

Go ahead and click "Delegate permissions"

You should now see a new "Select permissions" section.

In the search bar type offline_access, that should show the offline_access permission. Select it add then click "Add permissions"

Repeat the process for the following permissions: . IMAP.AccessAsUser.All . User.Read

After you add all the above permissions, your permissions table should look something like the following:

Now go back to your App Registration main page, by clicking "Overview" on the sidebar.

2.5. Define the Return URI 

Our next step is to set the configurations on the "Authentication" like the Return URI and others.

Back on your App Registration main page

Click the "Redirect URIs" link

This should have taken you to the "Authentication" page.

Here you should see the Return URI that you previously configured

After that enable the "Access tokens (used for implicit flows)" option on the Implicit grant and hybrid flows section

Now go back to your App Registration main page, by clicking "Overview" on the sidebar.

2.6. Retrieve the endpoint information 

The last step you need to take is to retrieve the following endpoints:

Back on your App Registration main page

Click in the "Endpoints" link.

This should open a sidebar like the following

From the sidebar copy and take note of the following endpoints, that will be required to configure KiyoCRM

3. Configure the Microsoft Provider in KiyoCRM 

In the following steps we are going to configure a provider that can be used by multiple users within KiyoCRM. This scenario only makes sense when you have registered an app in azure for accounts that share the same domain, usually accounts that are not @outlook accounts or similar.

Since we are going to configure a Group OAuth provider, the following steps are needed to be done by an admin user

Login into KiyoCRM as an admin user and go to the admin panel

On the admin panel search for "External OAuth Providers"

Click on the "External OAuth Providers", that should take you to the module list view

As an admin you can create two types of records:

As mentioned before in this guide we are going to configure a provider that will be used by multiple users, so we are going to create a group record.

Click on the "New Group OAuth Provider" which should take you to the create view.

Add a meaningful name to your provider, it can be just "Microsoft", the name of your domain, or something that helps you identify and differentiate the provider from other possible providers.

Then select the "Microsoft" on "Connector" field

The Microsoft connector type works in the same way as the "Generic" connector type. The difference is that it has several built in defaults. This spares you some configuration steps and makes the process of configuring an External OAuth provider easier.

Add the "Scopes" that you want to access, the same ones you’ve configured on Azure’s API Permissions page.

Set the "Client Id" that was generated in Azure

Set the "Client Secret" that was generated in Azure

Set the "Authorize URL" that you’ve copied from the Azure endpoints ( OAuth 2.0 authorization endpoint (v2) )

Set the "Access Token URL" that you’ve copied from the Azure endpoints ( OAuth 2.0 token endpoint (v2) )

Your record should now look something like the following:

Since many of the other fields have defaults and the Microsoft connector adds other defaults, these are all the field that you should need to configure.

You can now save the record

4. Configure User Inbound emails 

Now users should be able to use the OAuth Provider you have created for authenticating with Microsoft.

Check the How to configure Inbound Email with OAuth guide for the steps users need to take to configure their inbound emails using an OAuth connection.

1. Intro

On KiyoCRM 7.13.1 and 8.2.3 versions, the “From” dropdown list, depicted on the following image, has been updated.

As well as the new styling, the field behaves differently.

By default, it now shows the list of all Outbound Email Accounts the user has access to, which includes the personal accounts and group accounts.

In addition to the above it will also show the System Email if the Users may send as this account’s identity option is enabled in the Administration > Email Settings page.

2. Legacy Email behavior config option

2.1 Option description

A new legacy_email_behaviour config option has been added, which allows you to keep some of the legacy Compose “From” behavior.

It will get the list of 'from email addresses' that was generated in previous versions of KiyoCRM and add it to the new list that is generated based on the Outbound Email Accounts.

As you might know, the previous behaviour was to generate the list from addresses based on the Inbound Email Accounts.

2.2 Note on Upgraded Versions

Newly installed instances will have the legacy_email_behaviour option disabled by default.

Instances that have been upgraded from a previous KiyoCRM version will have the newly added legacy_email_behaviour config.php option enabled in order to keep legacy behaviour.

3. Email Signatures

The Outbound Email Account configuration has been updated to allow configuring an email signature per outbound email account, as depicted in the image below. This signature can be defined both for Personal and Group Outbound Email Accounts.

The group signatures will be accessible by any user that has access to the Outbound Email Account record.

Please note that signatures do not support embedded images, only images that are available in a public url.

1. Intro

This guide will explain how to configure an inbound email connection using a previously configured OAuth Provider.

As example we will use a Microsoft account, however the steps should be similar for other providers

In this guide we will be configuring a personal account using a group OAuth Provider. Group OAuth providers are meant to be used by many users in the system.

As an admin you can create three types of records:

If you haven’t yet configured the OAuth Provider or don’t know how to, please have a look at How to configure a Microsoft OAuth Provider Guide

2. Create an OAuth connection

Login into you KiyoCRM instance

This module is the one that will keep the reference of all the existing OAuth Connections. It stores the tokens generated after the authentication.

Let's create a new Personal OAuth Connection. click on "Personal OAuth Connection"

This should take you to the creation view.

Add a meaningful name to your connection, it can be the username of your account, or something that helps you identify and differentiate the connection from other existing connections.

Now select on the "Provider" field, select the Microsoft OAuth Provider that you previously created.

After selecting the provider, it is time to authenticate, click on the "Authenticate" button.

When clicking the button, a popup window should display with the Microsoft page for Authentication.

After going through all the authentication popup steps, the popup should close and the fields on the External OAuth Connection record should be populated.

Do not store or share any of the tokens. These work almost as passwords. They are sensitive information.

Go ahead and save your record.

3. Configure an Inbound Email Account

Now it is time to create an Inbound Email Account. Click on the "Inbound Email Accounts" in Admin page

This should take you to the Inbound Emails module list view.

Lets create a new Personal Inbound Email Account. click on "New Personal Inbound Email Account"

This should take you to the create view

Add a meaningful name to your inbound, it can be the username of your account, or something that helps you identify and differentiate this inbound email account from other existing accounts.

Select the "OAuth" type on the Auth Type field.

By selecting the OAuth type, the "External OAuth Connection" field should now display. Click on the arrow to select the OAuth Connection you created before.

Group Inbound Emails should be linked to Group External OAuth Connection records. If they are linked Personal External OAuth Connection records errors may occur

Click on the arrow button should open a popup where you can select the OAuth Connection we’ve created before.

Enter the username for your account. It should be the same you’ve used to create the OAuth Connection.

Enter server address for your account. E.g. for Microsoft it would be outlook.office365.com.

Here we are using a Microsoft account as example. Though you should set the address of the server you are using

Depending on your server configurations enable the ssl and set the port. E.g. for Microsoft you should enable the "Use SSL" checkbox which is going to change the port to "993" which is the default.

Here we are using a Microsoft account as example. Though you should set the port of the server you are using

The Email Body Filtering Search Type allows the user to choose to search using 1 word or a multiword search.

Now set the values for the folders. Click the "Select" button next to each folder to open the popup that will show you the available values.

Do not try to fill these fields before setting the following fields: External OAuth Connection, Username, Mail Server Address, Mail Server Port, Use SSL. Otherwise, you will just see an empty dropdown on the popup.

For Microsoft: the following is an example of how the fields should look after being configured:

Next, set the value for the other fields. The following is an example of a fully configure account, except for the "Outbound Email Account" field which is not in the scope of this guide to explain how to configure

Go ahead and save your record.

4. Configure the Inbound Email to display on the Emails module

For the configured account to show on the email's module, you need must go to your profile and select it as one of the accounts to show.

On the navbar global menu click on "Profile"

This should take you to the profile page.

Scroll to the end of the page a click on the "Settings" button

This should open a modal with a "Folder Management" section at the end. On this section select the accounts that should display on your Emails module.

It is possible to select multiple accounts.

Click "Done"

Go ahead and save your profile.

That should be your Inbound Email account configured.

5. Access the Configured account on emails module

On the menu click on the "Emails" module link

On the menu click on the "Emails" module link.

Depending on the number of Inbound Emails you have configured, the inbound you have just configured may not be the one to display by default.

To change to the Inbound Email account you have just configured click on the current inbox button, located on the top right.

A modal should show with the Inbound Email accounts you have configured on the Folder Management within your profile

Within the modal, click on the Inbound Email Account you have just configured. That should reload the page and show the Inbound Email that you configured

1. Intro

This guide tries to provide a more in-depth description of the configurations in the External OAuth Provider module

2. Types Of records

As an admin you can create two types of records:

Please check the Configuring Security Groups for Inbound Email on more information in the differences between the two and how to use them properly.

3. OAuth2 Client lib

KiyoCRM is using the OAuth 2.0 Client from The PHP League. It uses the Generic Provider for all the providers.

4. Base Config_

On the base configuration, depicted below, you can find all the fields that are essential for the OAuth Provider to work. This may vary depending on the provider that you will be using, but most of these field are common for most providers.

5. Extra Configurations

These are extra configurations that you may need to add depending on the provider. All the below are merged with any existing defaults.

6. Mapping Configurations

These define how to map the fields received on the token, to the fields where they are store in KiyoCRM. All the except for token type have defaults.

In this configuration it is possible to retrieve values nested within an array. For that you can define the path to the field using the key names and using . to join them. E.g. Microsoft connector uses the following mapping to get the token type values.token_type

7. Connectors

Connectors are the part of the code that is responsible for managing the requests to the provider to do the authentication

The Microsoft connector type works in the same way as the "Generic" connector type. The difference is that it has several built in defaults. This spares you some configuration steps and makes the process of configuring an External OAuth provider easier.

8. Internal Configuration Format

In order to understand how/when the fields from the External OAuth Providers module are used, it may help to understand the internal structure.

The following code snippet is an example of the configurations without the shortcuts from the frontend.

[
    'type' => 'Generic',
    'client_id' => '...',
    'client_secret' => '....',
    'redirect_uri' => '....',
    'authorize_url_options' => [
        'scope' => '...',
    ],
    'extra_provider_params' => [
        'scopes' => '...',
        'urlAuthorize' => '...',
        'urlAccessToken' => '...',
    ],
    'get_token_request_grant' => 'authorization_code', // optional
    'get_token_request_options' => [], // optional
    'refresh_token_request_grant' => 'refresh_token', // optional
    'refresh_token_request_options' => [], // optional
    'token_mapping' => [ // optional
        'access_token' => '...',
        'expires_in' => '...',
        'refresh_token' => '...',
        'token_type' => ''
    ]
]

From the above example you can see that:

Roles and Security Group settings are managed from the Users section of the Administration Panel.

The settings allow you to restrict access to sensitive data in KiyoCRM to specific teams (groups). There are many options to allow you to configure it to your exact needs, and a number of automatic assignment options to ensure that your users can always access the data that they need.

Security Groups allow you to define groups of users with particular access rights defined by the roles attached to the group. Groups can also be used to assign records to teams of users.

Roles are used to define access rights to modules and determine what a user can do with a record once they have access to it.

There are 3 key steps to setting up Groups so that you work correctly.

Further advanced security group settings and functionality are available with the purchase of the Security Suite add-on

Role Management

Create a role to define access to modules and the functions users will be able to perform on records within these modules. The role can then be assigned to security groups or to individual users where appropriate.

Create Role

Select Role Management and then Create Role from the Role Management sidebar.

Enter a name and a description for the role you are creating and click Save.

Once the role has been created, the role matrix will be displayed, showing all the configurable access options for each module.

Click on a cell to change the access setting. Note that you can change the setting for an entire column by clicking on the column heading.

Use the Access column to determine whether users can access each module:

Use the Delete, Edit, Export , Import, List, Mass Update and View columns to determine available record functions for users:

Click Save Once saved, access rights are color coded for ease of reading.

If your users should only typically see their own records, then the role you would assign to their group would be configured to have Owner rights. A manager who is a part of the same group, but who should be able to see all records in the group should have a role directly assigned to their user record that gives Group access.

Add User or Group

Assign the role to a group or an individual user as appropriate, using the subpanels below the matrix.

List Roles

Select List Roles from the sidebar to view all roles and their descriptions.

Click on the role name to view and edit the access settings.

Click on the pencil icon to edit the role name and/or description.

List Roles by User

Select a username from the list to display the access matrix for the user as defined by all roles applied to the user.

Security Suite Management

Select Security Suite Management from the Admin panel to view any existing groups or create a new group.

Create Group 

Create a group to define groups of users with particular access rights which are defined by the roles attached to the group. Groups can also be used to assign records in the CRM.

Select Security Suite Management, and then Create a Security Group from the sidebar.

Enter a name and an optional description for the group.

Not Inheritable If this field is checked then the group will not automatically be attached to any record. This can be useful for cases such as creating groups to assign roles to.

Click Save.

The Detail view for the newly created group will appear.

Add Users and Roles

Add users and roles to the group as required, using the subpanels.

Here, Chris and Sarah are members of the group and the Owner Only role has been applied, so the Owner Only role settings will apply to both Chris and Sarah.

View Security Groups

Select Security Groups from the sidebar to view all security groups.

Click the group name to edit the users and roles attached to the group, and the pencil icon to edit the group name and/or description.

Security Suite Settings

KiyoCRM System Administrators can configure many advanced options for Security Suite. This allows you to control various access rights, inheriting of records, filters and more.

Additive Rights

User gets greatest rights of all roles assigned to the user or the user’s group(s)

Strict Rights

If a user is a member of several groups only the respective rights from the group assigned to the current record are used.

New User Group Popup

If this is checked, a Security Groups popup will open when a new user is created, allowing you to add the user to a security group(s)

User Role Precedence

If any role is assigned directly to a user that role should take precedence over any group roles.

Filter User List

With this selected, non-admin users can only assign records to users who are in the same group(s)

Use Creator Group Select

Adds a panel to a record creation screen if a user is a member of more than one inheritable group that allows a user to select one or more groups (that the user belongs to) that should be associated with the newly created record. If a user is in just one group the normal inheritance rules will instead be applied.

The new record will still inherit from the Assigned To user or Parent record if these options are set. This setting only overrides the Created By setting.

Inherit from Created By User

The record will inherit all the groups assigned to the user who created it.

Inherit from Assigned To User

The record will inherit all the groups of the user assigned to the record.

Other groups assigned to the record will NOT be removed.

Inherit from Parent Record

E.g. If a case is created for a contact the case will inherit the groups associated with the contact.

Inbound email account

Locks down inbound email accounts in the email client to only list those that belong to the same group as the current user.

Default Groups for New Records

Set groups that should always be attached when a specific module record is created, e.g. you can set a group to be assigned to all newly created Account records.

System Settings 

User Interface 

These user interface settings apply system-wide, although some (for example Show Full Names) can be overridden by individual users in their user profile.

Configure AJAX User Interface 

Click the Configure Ajax User Interface link to display the configuration options.

Drag and drop modules between the columns to enable/disable AJAX.

Proxy Settings 

Select the Use Proxy server? checkbox to configure proxy server address and authentication settings.

Google Authentication 

This is where you upload the JSON credential file for Google Calendar Sync.
See the Google Credentials and Syncing Section.

Advanced Settings 

Logger Settings 

Specify log filename, extension and size as well as the log level here. See the chapter on logging for more information.

Click the View Log link to view the log file.

Import Wizard 

The Import Wizard is also available from the sidebar of all import-enabled KiyoCRM modules. Select the module to import data into and click Next to launch the wizard.

Locale 

Set system-wide settings for locale here, including date and time formats, system currency and export settings. Currencies can be added to KiyoCRM via the Currencies panel.

Note that date and time settings can be overridden by the user in their user profile

Upgrade Wizard 

The Upgrade Wizard provides a quick and simple way to upgrade your KiyoCRM application. Download the required upgrade package and check your system compatibility before running the wizard.

See Using the Upgrade Wizard for full instructions on upgrading.

Currencies 

Use this section to add a currency to KiyoCRM. The default currency can be set in the Locale section.

Entering the ISO 4217 code for the currency will autofill the Currency Name and Currency Symbol fields.

You must also specify a currency conversion rate before saving the new currency settings.

Backups 

The KiyoCRM application files can be backed up using this tool. Please note that you should also perform regular backups of your database - see the vendor’s documentation for details on how to do this.

Languages 

Download language packs for Store here.

Repair 

Selecting Repair from the System Settings panel displays a wide range of repair options for KiyoCRM which will run automatically when the link is clicked. KiyoCRM may direct you to run particular Repair commands, for example following an upgrade using the Upgrade Wizard.

Quick Repair and Rebuild is the most often used command here and will be required after installing a new module via Module Loader for example, or to display changes to code during development when Developer Mode is not set.

When running a Quick Repair and Rebuild, be sure to scroll to the bottom of the page to view any new SQL code which may need to be executed to ensure that your database tables are correctly synced with any changes that have been made.

The following functions are available to you in the section:

Global Search 

The Global Search functionality is used to search for records using the search bar on the main navigation menu. Add or remove modules from the Global Search here.

See the User Interface guide to the global search for more information.

Diagnostic Tool 

The diagnostic tool allows you to gather system configuration information which can be downloaded via a .zip file for analysis.

Select the information you require and click Execute Diagnostic.

Once complete, click the link to download the zipped diagnostic file.

Connectors 

This section to be completed.

Themes 

From 7.9 onwards, only the Kiyo theme is available. For earlier versions, you can set the default theme, and which other themes are available for users to select here.

From 7.10 onwards, there is a choice of theme colors for Kiyo which can be set from the User profile.

Scheduler 

KiyoCRM uses a number of Scheduler jobs running at scheduled times, supporting functionality such as search indexing, workflows, email notifications, database maintenance and sending campaign emails.

Setting up the Scheduler 

Scheduler jobs need to be manually enabled. This is done by running a script called cron.php every minute. This, in turn, manages all KiyoCRM jobs according to their proper schedules.

In Windows this is setup using Task Scheduler, and in Linux and iOS, it is setup in crontab. Detailed instructions for your system will be displayed during installation and can also be found on the Schedulers page, under the list of scheduled jobs.

See Scheduler Jobs in KiyoCRM in Linux - the Definitive Guide for an in-depth guide to setting up and managing scheduled jobs in Linux.

Configuring Scheduled Jobs 

Click on a scheduled job to view settings

In edit mode, you can set the job status (only Active jobs will run) and configure the interval at which the job runs as well as the start time. Unchecking the 'Advanced Options' box will show a more user-friendly way to set the job interval if you are not familiar with the crontab notation. Re-checking Advanced Options will let you set the initial start time.

Activity Streams 

By default, the Activity Stream dashlet displays recent updates for the Opportunities, Contacts, Leads and Cases modules.

The Activity Stream admin panel allows you to configure what is displayed on the activity feed and which features are available to users.

Please see the user interface guide for further information on how to use the Activity Stream.

This enhancement is only available in KiyoCRM from version 7.11 onwards.

KiyoCRM Elasticsearch engine makes use of Elasticsearch’s Query String DSL. This allows very advanced search query to be performed.

For a complete understanding check the official documentation. A quick overview will be provided here.

Examples 

Search for all the records having both 'John' and 'Doe' in any field:

John AND Doe

Search for all the records having the first name 'John' (note that this won’t include 'Johnny'):

name.first:John

Search for all the records having with the name starting with 'John':

named:John*

Search for all the Accounts having 'corp' in their name:

named:corp AND _type:Accounts

Joining 

By default, keywords are joined by OR clauses, meaning that searching for John Doe will be the same as searching for John OR Doe. Of course, results containing both 'John' and 'Doe' will appear on top.

Boosting 

Names are boosted, meaning that if one of the keywords matches in the name the record will very likely appear on top.

Wildcards 

By default the entire keywords must match. Thus, searching with 'John' won’t match someone named 'Johnathan'. To do that you need to use a wildcard character. Can be use interchangeably to replace zero or more characters. ? can be used to replace exactly one character.

Search for both 'John' and 'Johnathan':

named:john*

Search for all the surnames starting with either 'Mc' or 'Mac':

name.last:(Mc* OR Mac*)

Wildcards can be used at the beginning of the keyword too, but it will make the search slightly slower.

Search for all the records having the last name ending with 'Connor':

name.last:*connor

Searching by modules 

You can restrict search to one or more module by using the _type keyword and the module name.

Search for all the Users:

_type:Users

Fuzzy search 

Using the ~ will make a keyword fuzzy, meaning that it will make a proximity search, finding all matches that have one different character (distance). The distance can be customized by adding a number after the tilde,

Search for 'Mackenzie', 'McKenzie', 'Makenzie', etc.

MacKenzie~3

Metadata 

Each records have the following meta fields that can be searched:

Search all the records created by 'John Doe':

meta.created.user_name:(John Doe)

Search all the records modified on the first of August.

meta.modified.date:"2018-08-01"

This enhancement is only available in KiyoCRM from version 7.11 onwards.

KiyoCRM’s Elasticsearch integration ships with two useful command-line tools powered by Robo.

These two commands allow to perform indexing and searches from the command-line, making debug and integration with external tools easier.

These commands require a working connection to the database, if you are running KiyoCRM behind Docker or a VM, please execute them from a shell on the same host as the KiyoCRM web server.

elastic:index 

The elastic:index command allows to run an indexing from the command-line and see the step-by-step logs. Both partial and full indexing are supported.

Usage 

elastic:index [<differential> = 1]

Examples 

Running a full indexing:

vendor/bin/robo elastic:index 0

Running a partial indexing:

vendor/bin/robo elastic:index 1

elastic:search 

The elastic:search command allows you to perform the same kind of queries you would do from the search bar directly from the CLI. It also allows to return a JSON with additional data about the record.

Usage 

elastic:search <query> [<size> = 20] [<showJson> = false]

You can use the full query syntax for query argument.

The size option specifies the number of results.

When the showJson option is enabled, a JSON will be returned for each result

Examples 

Search for everything using the keyword 'Rohan':

vendor/bin/robo elastic:search "rohan"

Search for the first account named 'Maxwell' and show a JSON:

vendor/bin/robo elastic:search "_type:Accounts AND named:Maxwell" 1 true

This enhancement is only available in KiyoCRM from version 7.11 onwards.

In order to make the troubleshooting process easier for the Elasticsearch extension, a separate file is used to offer very verbose and dedicated logging: search_index.log. This is mostly because the indexing procedures are run in the background, where they are hard to debug. Logging calls get redirected to the standard logging, filtered with the configured logging level.

In addition to checking the logs, you could try running the search or the indexing from the command-line using the command line tools. Given the verbosity of the console output, this should surely help to narrow down the issue.

Finally, enabling developer mode in the admin settings, will provide a clear exception page if the error happens at some point during the search process.

Introduction 

The Studio tools allow you to customize the information shown in the modules and how it is displayed.

To access Studio, log in as an Administrator user. In the top-right corner of the screen you find a menu with a profile figure icon. Click this icon, then select "Admin". Scroll down the page and click "Studio".

When Studio is opened, it will display a list of all the modules which can be customised. Click to select the required module.

For each module, there are several components which can be edited.

Labels: View/edit field labels and the module name

Fields: View/edit field properties and add new fields

Relationships: View/edit/add relationships between modules

Layouts: Customise the edit/detail/list and filter views

Subpanels: Set which columns are displayed on module subpanels

Labels 

Selecting the Labels component lists all the field labels for the module. Edits to labels will be reflected on the module layouts.

Click and type to make the required changes to the labels and then click SAVE & DEPLOY.

A confirmation message will appear once the changes have been saved. You should now be able to see the changes to the labels when you navigate to the module.

Clicking CHANGE MODULE NAME will allow you to change the label for the module itself. See the Rename Modules section of the Developer Tools documentation for more details.

Fields 

Selecting the Fields component displays all the available fields for the module, with their display label and data type.

Adding A Field 

You can add a custom field to the selected module by clicking ADD FIELD.

Enter the details for the new field. Depending on the data type selected for the field, some or all of the following properties can be set for the field:

Field Types 

Studio comes out-of-the-box with many different types of fields which can be created in KiyoCRM.

The following data types are available when creating fields in Studio:

Adding A Dropdown Field 

When adding a field of type Dropdown, you need to additionally specify the dropdown list. This contains the list items which will be displayed for the dropdown.

You can select an existing dropdown list if appropriate or click ADD to create a new one.

For each item to include in the list, enter:

Click ADD to add each new entry.

To add a blank item, click ADD without entering any values for the Item Name and the Display Label. It is not possible to add a blank name, but with a non-blank label.

The list can be optionally sorted alphabetically by the Display Label by clicking the appropriate SORT button. If you want to set a default item, this is not the place to configure that; instead, look for a "default value" option in the settings for the field that will be using this dropdown.

Click SAVE to save the new dropdown list and return to the field properties.

The dropdown list items you have created will now be visible. If desired, you can select a default value for the dropdown.

Editing A Field 

Click on a field to view the field’s properties. These can be edited in the same way as detailed above for adding a new field.

Deleting A Field 

Only fields that have been created in Studio can be deleted via Studio. Core fields cannot be deleted.

Select the field you wish to delete and click DELETE A warning message will appear asking you to confirm the deletion as both the field and any data related to the custom field will be deleted from the database and the field will no longer appear on any module views.

Relationships 

A relationship represents a two-way link between two modules. Selecting the Relationships component displays all the relationships between the currently selected module and other deployed modules.

Click on a relationship to view the relationship properties.

Click ADD RELATIONSHIP to add a new relationship for the selected module.

The Primary Module will be set to the currently selected module.

Specify the relationship type:

One to One

With a One-to-One relationship, each record in the primary module may only have one related record in the related module, and vice versa. This type of relationship will add a relate field to both modules' records.

One to Many

With a One-To-Many relationship, records in the primary module may be related to one or more records in the related module, but each related module record is only related to one primary module record. This will add a relate field to the related module’s records, but the primary module will display a subpanel where more than one related module records can be added.

Many to Many

With a Many-To-Many relationship, records in the primary module can be related to one or more records in the related module, and vice versa. Each module’s records will contain a subpanel for the related records.

Select the Related Module from the dropdown list.

Where there are subpanels, subpanel views for the module(s) can be selected.

Click SAVE AND DEPLOY to save the relationship.

Layouts 

Layouts can be edited in Studio to customize the module views shown to users.

Edit View 

Edit view is displayed when editing a record or creating a new one.

The current layout is displayed in the main panel on the right-hand side. Unused fields are shown in the list on the left hand side.

Select Sync to Detail View if you wish any changes made to fields or field placement to be automatically applied to the corresponding Detail View. Note that layout changes cannot be made to the Detail View when this option is set.

Adding Fields

Fields can be added to the view either as a new row in an existing panel (section), or by adding a new panel.

Click and drag the New Row or New Panel element to the desired location in the layout on the right-hand side.

If you have added a new panel, this can be renamed by clicking the pencil icon. This will open the edit view for the panel label. Edit the label and click SAVE to return to the layout.

A new row will automatically be created with two columns.

Drag and drop the required fields to the new row. Clicking the + button will span the field across both columns.

Click SAVE AND DEPLOY to save the layout changes. These should now be visible when you navigate to the Edit view for the module.

Deleting Fields

Delete fields, row or panels from the layout by dragging them to the Delete area on the left-hand side.

Click SAVE AND DEPLOY to save the layout changes.

Detail View 

Detail View is a read-only view, shown when a record is opened.

The Detail View layout can be edited in exactly the same way as for the Edit View. Note that if you have Sync to Detail View selected on the Edit View, you will not be able to make changes to the Detail View.

List View 

The List View is shown when a module is opened and lists all the records in the module.

Customise which fields are shown in the list view, and the order in which they are displayed here.

Drag and drop the module fields between the columns to customize the list view.

Subpanels 

Use this section to customize which fields are shown on a particular subpanel.

Select the subpanel. Fields shown in the Default column will be shown on the subpanel. Drag and drop the required fields between the two columns.

Click SAVE & DEPLOY

Export Customizations 

You can export module customizations that you have made in Studio, and upload these into another KiyoCRM instance via Module Loader

Enter a name for the package, and optional author and description details.

Select the module(s) that contain the customisations you wish to export. Only modules containing customisations will appear for you to select.

Click EXPORT. This will create and download a .zip file containing the module customizations. Use Module Loader to upload and install the customizations on another KiyoCRM instance.

Azure SAML Single Sign On

The following documentation is for KiyoCRM Version 7.x; to see documentation on the same topic for Version 8+

Azure SAML Single Sign On 

KiyoCRM can utilize a third-party identity provider such as Microsoft Azure Active Directory and the SAML protocol to achieve single sign-on authentication. You can then use Azure AD to control who has access to KiyoCRM and enable automatic sign in.

Considerations

1. Setup APP in Azure 

The first step is to create a new Enterprise Application in Azure. This app defines how Azure, as the Identify provider (IdP) will interact with your KiyoCRM instance. Doing so will also provide you with the required values and certificate to configure KiyoCRM. SAML apps in Azure are unique to each instance, as the CRM URL is verified as part of the sign in process. If SAML is needed for multiple staging, test or production environments a new app will be needed for each.

1.1. Create the new application 

Login to Microsoft Azure and navigate to 'Azure Active Directory' section using the icon on the home page

From the left-hand Menu select 'Enterprise applications'

From the top menu, select 'New Application'

From the top menu, select 'Create your own application'

A new side window will open; you can use this to create your application.

1.2. Configure the new application 

From the left-hand Menu select 'Single sign-on' from the Manage category

Select SAML from the available options

Click on the pen icon to Edit the Basic SAML Configuration

KiyoCRM uses the same value for Entity ID, ACS URL and Sign On URL.

The value should be your KiyoCRM URL in the following format:

{CRM URL}/index.php?action=Login&module=Users

For example: https://kiyocrmdemo.com/index.php?action=Login&module=Users

1.3. Store the required settings for later use 

Scroll down to the SAML Certificates section and download the Certificate (Base64) and store it for later

Scroll further down and store the Login URL and Logout URL and again, store these for later.

2. Add users to APP in Azure 

Before your users can login to KiyoCRM using SSO with Azure, they must be added to the newly created application. Users can be added individually or in groups, depending upon how your Azure Active Directory is configured. Only users which have been added to the KiyoCRM SAML Authentication' Application will be able to login.

From within your newly created Enterprise Application:

You can now assign either users or groups to your KiyoCRM SAML Authentication' Application.

3. Setup SAML in KiyoCRM 

Before you can finish setting up your users in KiyoCRM you must first enable SAML. Once this step is complete your users will no longer be able to login in the normal way and SSO must be used.

3.1. Enable SAML 

Sign in to KiyoCRM as an administrator

Go to Admin → Password Management

Select Enable SAML Authentication

In the SAML Authentication section, add the following information

Save your changes

3.2. Enable SAML for your users 

Once KiyoCRM has been configured to use SAML, you can configure your individual users to use SAML to login. You must complete this step for each user who will login using SSO.

AOS Settings 

The Advanced Open Sales suite of modules allow you to manage the post-Opportunity Sales processes such as Quoting, Invoicing and recurring Contracting.

You can customize the following settings within the AOS Settings:

Once configured, click Save to apply your AOS Settings.

AOD Settings 

Enable or disable KiyoCRM's full text global search here.

The full text global search is powered by Zend Lucene search framework. The search works very similar to the standard global search but provides the enhanced functionality of searching text in documents and other files, compared to the record-level search provided by the standard global search.

AOP Settings 

Here you can enable or disable the Advanced Open Portal functionality, configure the Joomla URL, set the case distribution method, the 'from' name and email address and configure the email templates.

Business Hours 

Specify business working hours here.

These settings will determine when workflows set to run 'Only In The Scheduler' will run and will be used when "Consider Working days" is set on Project records.

This enhancement is in Beta please help by providing us your feedback! It is only available in KiyoCRM versions 7.11 and newer.

Overview 

KiyoCRM has the ability to synchronize a user’s meetings with their Google Calendar. This is a bidirectional sync, and changes on either end of the synchronization cause updates on the other.

There is no middle man in this process. Your data does not pass through any 3rd parties. It’s just your KiyoCRM instance, and Google’s servers.

Requirements 

Valid API Credentials 

In order to synchronize a user’s KiyoCRM meetings with their Google Calendar, the system must have valid credentials saved.

These credentials are created on the Google Developer’s Console, downloaded as a JSON file, and imported into KiyoCRM. There are instructions on how to do this further down this page.

Internet Access from the KiyoCRM Server 

The KiyoCRM server must also have access to the internet. However, the KiyoCRM server does not need to be publicly accessible. The user must be able to reach both Google and KiyoCRM at the same time to authorize calendar access. Once that is done, the synchronization process runs on a schedule without any user interaction. The user does not need to be logged in to KiyoCRM for the synchronization to function.

At Least One Google Account 

You’ll need a Google Account to create the API credentials, and an account to synchronize with. They can be the same account if you only have one user. The API credentials only need to be generated once, from a single account. These credentials can be used to synchronize all the users once they authorize access to their account. These accounts can be generic @gmail.com accounts, or any level of GSuite accounts (Basic/Business/Enterprise).

Generating & Installing Google Credentials 

Generating Credentials 

Make sure you’re logged into a Google account before proceeding.

Go to Google Developers Console

Installing Credentials 

Log into SuiteCRM as the administrative user.

Go to ‘Administration’.
Then scroll down to the 'Google Suite' section.
Click on the 'Google Calendar Settings' item.

If you ever need to install new credentials, simply upload them. They will overwrite the old ones.

Authorizing Calendar Access 

This needs to be performed by the User to enable syncing with their Google Calendar

Check the ‘Enable Calendar Sync’ checkbox, and then click the ‘Save’ button.

That’s it! By default, the sync happens every quarter hour. That can be changed by the Administrator in the Scheduler configuration.

Known Issues 

If the value of "google_calendar_sync_name" is changed then this will cause ALL Meetings to re-sync. This is due to the fact that if the value changes, then Google detects all current meetings as new, unique Calendar items.

The best way to avoid this from happening is to not edit/change the "google_calendar_sync_name" that is located in your config.php file.

Disabling Google Calendar Sync 

If you want to disable the Google Calendar sync completely or re-add its token from scratch, perform these actions:

In order to reset Google authorization, user can reset their personal settings. It might be excessive if the token is already deleted from the admin config and the scheduler task is not active.