Topics and Tags Settings. salesforce Salesforce
Реклама
Реклама
Set Up and Maintain Your Salesforce Organization Topics and Tags Settings
Define Delegate Administrators
Enable delegated administrators to manage users in specified roles and all subordinate roles. You can assign specified profiles to those users, and log in as users who have granted login access to administrators. A delegated administration group is a group of users who have the same admin privileges. These groups are not related to public groups used for sharing.
1. From Setup, enter
Delegated Administration
in the
Quick Find
box, then select Delegated Administration and click New
2. Select or create a delegated group.
3. To allow the users in this group to log in as users in the role hierarchy that they administer, select Enable Group for Login Access. Depending on your org settings, individual users need to grant login access to allow their administrators to log in as them.
4. Click Save.
5. For each related list, click Add to define your delegated group details.
SEE ALSO:
Delegate Administrative Duties
EDITIONS
Available in: both Salesforce
Classic and Lightning
Experience
Available in: Enterprise,
Performance, Unlimited,
Developer, and
Database.com Editions
USER PERMISSIONS
To manage delegated administration:
•
Customize Application
To be a delegated administrator:
•
View Setup and
Configuration
Topics and Tags Settings
When you enable topics for objects, users can add topics to records so they can quickly retrieve related items using list views. With Chatter enabled, users can also see related items on the Records tab of each topic detail page. Enabling topics for an object disables public tags on records of that object type. Personal tags aren’t affected.
To use topics to organize records, enable topics
for accounts, assets, campaigns, cases, contacts, contracts, files, leads, opportunities, orders, solutions, custom objects, and English articles.
EDITIONS
Available in: Salesforce
Classic
Topic and tag settings are available in: All Editions
IN THIS SECTION:
Enable and Configure Topics for Objects
Enable topics for objects so users can add topics to records and organize them by common themes. This powerful feature is available with or without Chatter.
Allow users to add personal or public tags to most records. Tags are words or short phrases that users associate to records to describe and organize data in a personalized way.
USER PERMISSIONS
To modify topic and tag settings:
•
Customize Application
Delete Personal Tags for Deactivated Users
Your org can have up to 5,000,000 personal and public tags applied to records across all users. If your org is approaching this limit, delete personal tags for deactivated users.
244
Set Up and Maintain Your Salesforce Organization Topics and Tags Settings
Enable and Configure Topics for Objects
Enable topics for objects so users can add topics to records and organize them by common themes.
This powerful feature is available with or without Chatter.
Administrators can enable topics for accounts, assets, campaigns, cases, contacts, contracts, files, leads, opportunities, orders, solutions, custom objects, and English articles. For each object type, administrators specify which fields to use for topic suggestions.
EDITIONS
Available in: both Salesforce
Classic and Lightning
Experience
Note: Topics are only supported on English Knowledge articles.
Warning: When topics are enabled for an object, public tags are disabled for records of that object type.
1. From Setup, enter
Topics for Objects
in the
Quick Find
box, then select Topics
for Objects.
2. Select an object.
3. At the right, select
Enable Topics
.
Available in: Group,
Enterprise, Professional,
Performance, Unlimited,
Contact Manager, and
Developer Editions
USER PERMISSIONS
To enable topics for objects:
•
Customize Application
4. Select the text fields that you want to use for topic suggestions. (From a combination of the selected fields, up to 3 suggestions are made from the first 2,000 characters.)
5. Click Save to save changes for all objects.
Now, users with access to the enabled objects and appropriate topics permissions can:
•
See topic assignments and suggestions on records of that object type
•
Add and remove topics from records of that object type
•
Use topics on records of that object type to filter their list views
Additionally, if your organization uses Chatter, users can click any topic assigned to a record to go directly to a topic page. There, they’ll find other records on the topic, people who are knowledgeable about the topic, and other related information.
Enable Tags
Allow users to add personal or public tags to most records. Tags are words or short phrases that users associate to records to describe and organize data in a personalized way.
1. From Setup, enter
Tag Settings
in the
Quick Find
box, then select Tag Settings.
2. Select Enable Personal Tags and Enable Public Tags to allow users to add personal and public tags to records. Deselect both options to disable tags.
3. Specify which objects and page layouts display tags in a tag section at the top of record detail pages. The tag section is the only place where a user can add tags to a record.
For example, if you select only account page layouts, users in your org can only tag account records. If you select only account page layouts for personal tags and not public tags, users can tag account records only with personal tags.
EDITIONS
Available in: Salesforce
Classic
Tag settings available in: All
Editions
USER PERMISSIONS
To modify tag settings:
•
Customize Application
4. Click Save.
When enabling tags, keep these guidelines in mind.
•
You can also add tags to page layouts by editing a layout directly. However, you can’t add tags to feed-based page layouts.
•
Search results and the Tags page don’t display custom objects without an associated tab, even if tags are enabled for the custom object. If you want custom object records to appear, create an associated tab. The tab doesn’t have to be visible to users.
245
Set Up and Maintain Your Salesforce Organization Topics and Tags Settings
•
Customer Portal users can't view the tags section of a page, even if it is included in a page layout.
•
When Chatter is disabled, joined reports can’t be tagged.
SEE ALSO:
Adding Tags to the Sidebar
When you enable tags for your organization, you can add the Tags component to your users' sidebar.
This component allows users to navigate to the Tags page where they can browse, search, and manage their tags. It also lists each user's most recently used tags. To add this component:
1. From Setup, enter
Home Page Layouts
in the
Quick Find
box, then select Home
Page Layouts.
2. Next to a home page layout that you want to modify, click Edit.
3. Select the
Tags
checkbox and click Next.
4. Arrange the Tags component on your page layout as desired, and click Save.
Tip:
If you want the Tags component to appear on all pages and not just the Home tab, from
Setup, enter
User Interface
in the
Quick Find
box, then select User Interface, and select
Show Custom Sidebar Components on All Pages
.
SEE ALSO:
EDITIONS
Available in: Salesforce
Classic
Tag settings available in: All
Editions
USER PERMISSIONS
To modify tag settings:
•
Customize Application
Delete Personal Tags for Deactivated Users
Your org can have up to 5,000,000 personal and public tags applied to records across all users. If your org is approaching this limit, delete personal tags for deactivated users.
1. From Setup, enter
Personal Tag Cleanup
in the
Quick Find
box, then select
Personal Tag Cleanup.
2. Select one or more deactivated users and click Delete.
You can’t restore personal tags after you delete them.
SEE ALSO:
EDITIONS
Available in: Salesforce
Classic
Personal Tag Cleanup available in: All Editions
USER PERMISSIONS
To delete personal tags for deactivated users:
•
Customize Application
246
Set Up and Maintain Your Salesforce Organization Control Who Sees What
Control Who Sees What
Salesforce provides a flexible, layered data sharing design that allows you to expose different data sets to different sets of users, so users can do their job without seeing data they don't need to see.
Use permission sets and profiles to specify the objects and fields users can access. Use organization-wide sharing settings, user roles, sharing rules to specify the individual records that users can view and edit.
EDITIONS
Available in: Salesforce
Classic
Note: Who Sees What: Overview (Salesforce Classic)
Watch a demo on controlling access to and visibility of your data.
The available data management options vary according to which
Salesforce Edition you have.
Tip: When implementing security and sharing rules for your organization, make a table of the various types of users in your organization. In the table, specify the level of access to data that each type of user needs for each object and for fields and records within the object. You can refer to this table as you set up your security model.
Object-Level Security (Permission Sets and Profiles)
Object-level security—or object permissions—provide the bluntest way to control data. Using object permissions you can prevent a user from seeing, creating, editing, or deleting any instance of a particular type of object, such as a lead or opportunity. Object permissions let you hide whole tabs and objects from particular users, so that they don’t even know that type of data exists.
You specify object permissions in permission sets and profiles. Permission sets and profiles are collections of settings and permissions that determine what a user can do in the application, similar to a group in a Windows network, where all of the members of the group have the same folder permissions and access to the same software.
Profiles are typically defined by a user’s job function (for example, system administrator or sales representative). A profile can be assigned to many users, but a user can be assigned to only one profile. You can use permission sets to grant additional permissions and access settings to users. It’s easy to manage users’ permissions and access with permission sets, because you can assign multiple permission sets to a single user.
Field-Level Security (Permission Sets and Profiles)
In some cases, you may want users to have access to an object, but limit their access to individual fields in that object. Field-level security—or field permissions—control whether a user can see, edit, and delete the value for a particular field on an object. They let you protect sensitive fields without having to hide the whole object from users. Field permissions are also controlled in permission sets and profiles.
Unlike page layouts, which only control the visibility of fields on detail and edit pages, field permissions control the visibility of fields in any part of the app, including related lists, list views, reports, and search results. To ensure that a user can’t access a particular field, use field permissions. No other settings provide the same level of protection for a field.
Note: Field-level security doesn’t prevent searching on the values in a field. When search terms match on field values protected by field-level security, the associated records are returned in the search results without the protected fields and their values.
Record-Level Security (Sharing)
After setting object- and field-level access permissions, you may want to configure access settings for the actual records themselves.
Record-level security lets you give users access to some object records, but not others. Every record is owned by a user or a queue.
The owner has full access to the record. In a hierarchy, users higher in the hierarchy always have the same access to users below them in the hierarchy. This access applies to records owned by users, as well as records shared with them.
To specify record-level security, set your organization-wide sharing settings, define a hierarchy, and create sharing rules.
•
Organization-wide sharing settings—The first step in record-level security is to determine the organization-wide sharing settings for each object. Organization-wide sharing settings specify the default level of access users have to each others’ records.
247
Set Up and Maintain Your Salesforce Organization Control Who Sees What
You use organization-wide sharing settings to lock down your data to the most restrictive level, and then use the other record-level security and sharing tools to selectively give access to other users. For example, let’s say users have object-level permissions to read and edit opportunities, and the organization-wide sharing setting is Read-Only. By default, those users can read all opportunity records, but can’t edit any unless they own the record or are granted additional permissions.
•
Role hierarchy—Once you’ve specified organization-wide sharing settings, the first way you can give wider access to records is with a role hierarchy. Similar to an organization chart, a role hierarchy represents a level of data access that a user or group of users needs. The role hierarchy ensures that users higher in the hierarchy always have access to the same data as people lower in their hierarchy, regardless of the organization-wide default settings. Role hierarchies don’t have to match your organization chart exactly. Instead, each role in the hierarchy should represent a level of data access that a user or group of users needs.
You can also use a territory hierarchy to share access to records. A territory hierarchy grants users access to records based on criteria such as zip code, industry, revenue, or a custom field that is relevant to your business. For example, you could create a territory hierarchy in which a user with the “North America” role has access to different data than users with the “Canada” and
“United States” roles.
Note: Although it’s easy to confuse permission sets and profiles with roles, they control two very different things. Permission sets and profiles control a user’s object and field access permissions. Roles primarily control a user’s record-level access through role hierarchy and sharing rules.
•
Sharing rules—Sharing rules let you make automatic exceptions to organization-wide sharing settings for particular sets of users, to give them access to records they don’t own or can’t normally see. Sharing rules, like role hierarchies, are only used to give additional users access to records—they can’t be stricter than your organization-wide default settings.
•
Manual sharing—Sometimes it’s impossible to define a consistent group of users who need access to a particular set of records.
In those situations, record owners can use manual sharing to give read and edit permissions to users who would not have access to the record any other way. Although manual sharing isn’t automated like organization-wide sharing settings, role hierarchies, or sharing rules, it gives record owners the flexibility to share particular records with users that need to see them.
•
Apex managed sharing—If sharing rules and manual sharing don’t give you the control you need, you can use Apex managed sharing. Apex managed sharing allows developers to programmatically share custom objects. When you use Apex managed sharing to share a custom object, only users with the “Modify All Data” permission can add or change the sharing on the custom object's record, and the sharing access is maintained across record owner changes.
IN THIS SECTION:
Profiles define how users access objects and data, and what they can do within the application. When you create users, you assign a profile to each one.
Revoking Permissions and Access
Who Has Access to Account Records?
SEE ALSO:
248
Set Up and Maintain Your Salesforce Organization User Permissions and Access
User Permissions and Access
User permissions and access settings are specified in profiles and permission sets. To use them effectively, understand the differences between profiles and permission sets.
User permissions and access settings specify what users can do within an organization:
•
Permissions determine a user's ability to edit an object record, view the Setup menu, empty the organizational Recycle Bin, or reset a user's password.
•
Access settings determine other functions, such as access to Apex classes, app visibility, and the hours when users can log in.
Every user is assigned only one profile, but can also have multiple permission sets. When determining access for your users, use profiles to assign the minimum permissions and access settings for specific groups of users. Then use permission sets to grant more permissions as needed.
This table shows the types of permissions and access settings that are specified in profiles and permission sets.
In Profiles?
In Permission Sets?
Permission or Setting Type
Assigned apps
Tab settings
Record type assignments
Page layout assignments
Object permissions
Field permissions
User permissions (app and system)
Apex class access
Visualforce page access
External data source access
Service provider access (if
Salesforce is enabled as an identity provider)
Custom permissions
Desktop client access
Login hours
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
The available permissions and settings vary according to which Salesforce edition you have.
Permission sets available in:
Contact Manager,
Professional, Group,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
249
Set Up and Maintain Your Salesforce Organization
Permission or Setting Type
Login IP ranges
In Profiles?
In Permission Sets?
SEE ALSO:
Revoking Permissions and Access
Profiles
Profiles define how users access objects and data, and what they can do within the application.
When you create users, you assign a profile to each one.
EDITIONS
Watch how you can grant users access to objects using profiles.
Who Sees What: Object Access (Salesforce Classic)
Your org includes several standard profiles where you can edit a limited number of settings. With editions that contain custom profiles, you can edit all permissions and settings except the user license. In Contact Manager and Group Edition orgs, you can assign standard profiles to your users, but you can’t view or edit the standard profiles, and you can’t create custom profiles.
Every profile belongs to exactly one user license type.
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
Custom Profiles available in:
Professional, Enterprise,
Performance, Unlimited, and Developer Editions
IN THIS SECTION:
Work in the Enhanced Profile User Interface Page
In the enhanced profile user interface, the profile overview page provides an entry point for all settings and permissions for a profile.
Work in the Original Profile Interface
To view a profile on the original profile page, from Setup, enter
Profiles
in the
Quick Find
box, then select Profiles, then select the profile you want.
Every org includes standard profiles that you can assign to users. In standard profiles, you can edit some settings.
Profiles define how users access objects and data, and what they can do within the application. When you create users, you assign a profile to each one. To view the profiles in your organization, from Setup, enter
Profiles
in the
Quick Find
box, then select Profiles.
Instead of creating profiles, save time by cloning existing profiles and customizing them.
Viewing a Profile's Assigned Users
To view all users that are assigned to a profile from the profile overview page, click Assigned Users (in the enhanced profile user interface) or View Users (in the original profile user interface). From the assigned users page, you can:
Edit Object Permissions in Profiles
Object permissions specify the type of access that users have to objects.
250
Profiles
Set Up and Maintain Your Salesforce Organization
View and Edit Tab Settings in Permission Sets and Profiles
Tab settings specify whether a tab appears in the All Tabs page or is visible in a tab set.
View and Edit Assigned Apps in Profiles
Assigned app settings specify the apps that users can select in the Force.com app menu.
Enable Custom Permissions in Profiles
Custom permissions give you a way to provide access to custom processes or apps. After you’ve created a custom permission and associated it with a process or app, you can enable the permission in profiles.
View and Edit Session Timeout Settings in Profiles
Use Session Settings to set how many minutes or hours of inactivity elapse before a user’s authentication session times out. At the end of the session, the user needs to log in again.
View and Edit Password Policies in Profiles
To ensure that the appropriate level of password security is used for your organization, specify password requirements with Password
Policies settings for users assigned to a profile. Profile Password Policies settings override the organization-wide Password Policies for that profile’s users. If you do not set Password Policies on a profile, the organization-wide Password Policies apply. New profile
Password Policies take effect for existing profile users when they reset their passwords.
Password Policy Fields in Profiles
Specify password requirements with Password Policies settings. Refer to these field descriptions to understand how each one impacts a profile’s password requirements.
A permission set is a collection of settings and permissions that give users access to various tools and functions. The settings and permissions in permission sets are also found in profiles, but permission sets extend users’ functional access without changing their profiles.
App and System Settings in Permission Sets
To quickly navigate to other pages in a permission set, you can enter search terms in any permission set detail page.
View and Edit Assigned Apps in Permission Sets
Assigned app settings specify the apps that users can select in the Force.com app menu.
Assign Custom Record Types in Permission Sets
Enable Custom Permissions in Permission Sets
Custom permissions give you a way to provide access to custom processes or apps. After you’ve created a custom permission and associated it with a process or app, you can enable the permission in permission sets.
Manage Permission Set Assignments
You can assign permission sets to a single user from the user detail page or assign multiple users to a permission set from any permission set page.
SEE ALSO:
Edit Multiple Profiles with Profile List Views
Profiles
251
Set Up and Maintain Your Salesforce Organization
Work in the Enhanced Profile User Interface Page
In the enhanced profile user interface, the profile overview page provides an entry point for all settings and permissions for a profile.
To open the profile overview page, from Setup, enter
Profiles
in the
Quick Find
box, then select Profiles and click the profile you want to view.
From the profile overview page, you can:
•
Search for an object, permission, or setting
•
•
If it's a custom profile, delete the profile by clicking Delete
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
Note:
You can’t delete a profile that’s assigned to a user, even if the user is inactive.
•
Change the profile name or description by clicking Edit Properties
•
View a list of users who are assigned to the profile
•
Under Apps and System, click any of the links to view or edit permissions and settings.
Custom Profiles available in:
Professional, Enterprise,
Performance, Unlimited, and Developer Editions
USER PERMISSIONS
IN THIS SECTION:
Enhanced Profile User Interface Overview
App and System Settings in the Enhanced Profile User Interface
Search in the Enhanced Profile User Interface
To locate an object, tab, permission, or setting name on a profile page, type at least three consecutive letters in the Find Settings box. As you type, suggestions for results that match your search terms appear in a list. Click an item in the list to go to its settings page.
To view profiles:
•
View Setup and
Configuration
To delete profiles and edit profile properties:
•
Manage Profiles and
Permission Sets
Assign Record Types and Page Layouts in the Enhanced Profile User Interface
View and Edit Login Hours in the Enhanced Profile User Interface
For each profile, you can specify the hours when users can log in.
Restrict Login IP Ranges in the Enhanced Profile User Interface
Control login access at the user level by specifying a range of allowed IP addresses on a user’s profile. When you define IP address restrictions for a profile, a login from any other IP address is denied.
SEE ALSO:
Enhanced Profile User Interface Overview
Profiles
252
Set Up and Maintain Your Salesforce Organization
Enhanced Profile User Interface Overview
The enhanced profile user interface provides a streamlined experience for managing profiles. With it, you can easily navigate, search, and modify settings for a profile.
To enable the enhanced profile user interface, from Setup, enter
User Interface
in the
Quick Find
box, then select User Interface, then select Enable Enhanced Profile User
Interface and click Save. Your organization can only use one profile user interface at a time.
Note:
You can't use the enhanced profile user interface if:
•
You use Microsoft
®
Internet Explorer
®
6 or earlier to manage your profiles (unless you've installed the Google Chrome Frame
™
plug-in for Internet Explorer).
•
Your organization uses category groups on guest profiles used for sites.
•
Your organization delegates partner portal administration to portal users.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
Custom Profiles available in:
Professional, Enterprise,
Performance, Unlimited, and Developer Editions
SEE ALSO:
Work in the Enhanced Profile User Interface Page
USER PERMISSIONS
To enable the enhanced profile user interface:
•
Customize Application
App and System Settings in the Enhanced Profile User Interface
In the enhanced profile user interface, administrators can easily navigate, search, and modify settings for a single profile. Permissions and settings are organized into pages under app and system categories, which reflect the rights users need to administer and use app and system resources.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
App Settings
Apps are sets of tabs that users can change by selecting the drop-down menu in the header. All underlying objects, components, data, and configurations remain the same, regardless of the selected app. In selecting an app, users navigate in a set of tabs that allows them to efficiently use the underlying functionality for app-specific tasks. For example, let's say you do most of your work in the sales app, which includes tabs like Accounts and Opportunities. To track a new marketing campaign, rather than adding the Campaigns tab to the sales app, you select Marketing from the app drop-down to view your campaigns and campaign members.
Available in: Enterprise,
Performance, Unlimited,
Developer, and
Database.com Editions
In the enhanced profile user interface, the Apps section of the overview page contains settings that are directly associated with the business processes that the apps enable. For example, customer service agents may need to manage cases, so the “Manage Cases” permission is in the Call Center section of the App Permissions page. Some app settings aren't related to app permissions. For example, to enable the Time-Off Manager app from the AppExchange, users need access to the appropriate Apex classes and Visualforce pages, as well as the object and field permissions that allow them to create new time-off requests.
Note: Regardless of the currently selected app, all of a user's permissions are respected. For example, although the “Import Leads” permission is under the Sales category, a user can import leads even while in the Service app.
Profiles
253
Set Up and Maintain Your Salesforce Organization
System Settings
Some system functions apply to an organization and not to any single app. For example, login hours and login IP ranges control a user's ability to log in, regardless of which app the user accesses. Other system functions apply to all apps. For example, the “Run Reports” and
“Manage Dashboards” permissions allow managers to create and manage reports in all apps. In some cases, such as with “Modify All
Data,” a permission applies to all apps, but also includes non-app functions, like the ability to download the Data Loader.
SEE ALSO:
Enhanced Profile User Interface Overview
Search in the Enhanced Profile User Interface
To locate an object, tab, permission, or setting name on a profile page, type at least three consecutive letters in the Find Settings box. As you type, suggestions for results that match your search terms appear in a list. Click an item in the list to go to its settings page.
Search terms aren’t case-sensitive. For some categories, you can search for the specific permission or setting name. For other categories, search for the category name.
Item
Assigned apps
Objects
•
Fields
•
Record types
•
Page layout assignments
Tabs
App and system permissions
All other categories
Search for
App name
Object name
Parent object name
Example
Type
sales
in the Find Settings box, then select
Sales
from the list.
Let’s say you have an Albums custom object.
Type
albu
, then select
Albums
.
Let’s say your Albums object contains a
Description field. To find the
Description field for albums, type
albu
, select
Albums
, and scroll down to
Description
under
Field Permissions.
Type
rep
, then select
Reports
.
Tab or parent object name
Permission name Type
api
, then select
API Enabled
.
Category name To find Apex class access settings, type
apex
, then select
Apex Class Access
. To find custom permissions, type
cust
, then select
Custom Permissions
. And so on.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
The available profile permissions and settings vary according to which
Salesforce edition you have.
USER PERMISSIONS
To find permissions and settings in a profile:
•
View Setup and
Configuration
Profiles
If no results appear in a search:
•
Check if the permission, object, tab, or setting you’re searching for is available in the current organization.
•
Verify that the item you’re searching for is available for the user license that’s associated with the current profile. For example, a profile with the High Volume Customer Portal license doesn’t include the “Modify All Data” permission.
•
Ensure that your search term contains at least three consecutive characters that match the name of the item you want to find.
254
Set Up and Maintain Your Salesforce Organization
•
Make sure that you spelled the search term correctly.
SEE ALSO:
Enhanced Profile User Interface Overview
Assign Record Types and Page Layouts in the Enhanced Profile User Interface
In the enhanced profile user interface, Record Types and Page Layout Assignments settings determine the record type and page layout assignment mappings that are used when users view records.
They also determine which record types are available when users create or edit records.
EDITIONS
To specify record types and page layout assignments:
1. From Setup, enter
Profiles
in the
Quick Find
box, then select Profiles.
2. Select a profile.
Available in: Salesforce
Classic and Lightning
Experience
3. In the Find Settings... box, enter the name of the object you want and select it from the list.
4. Click Edit.
5. In the Record Types and Page Layout Assignments section, make changes to the settings as needed.
Available in: Enterprise,
Performance, Unlimited, and Developer Editions
Record types available in:
Professional, Enterprise,
Performance, Unlimited, and Developer Editions
Setting Description
Record Types
USER PERMISSIONS
Lists all existing record types for the object.
--Master--
is a system-generated record type that's used when a record has no custom record type associated with it.
When
--Master--
is assigned, users can't set a record type to a record, such as during record creation. All other record types are custom record types.
To edit record type and page layout access settings:
•
Manage Profiles and
Permission Sets
Page Layout Assignment
Assigned Record Types
Default Record Type
The page layout to use for each record type. The page layout determines the buttons, fields, related lists, and other elements that users with this profile see when creating records with the associated record type. Since all users can access all record types, every record type must have a page layout assignment, even if the record type isn't specified as an assigned record type in the profile.
Record types that are checked in this column are available when users with this profile create records for the object. If
--Master--
is selected, you can't select any custom record types; and if any custom record types are selected, you can't select
--Master--
.
The default record type to use when users with this profile create records for the object.
Profiles
The Record Types and Page Layout Assignments settings have some variations for the following objects or tabs.
255
Set Up and Maintain Your Salesforce Organization
Object or Tab
Accounts
Cases
Home
Variation
If your organization uses person accounts, the accounts object additionally includes
Business Account Default Record Type and Person Account Default Record Type settings, which specify the default record type to use when the profile's users create business or person account records from converted leads.
The cases object additionally includes Case Close settings, which show the page layout assignments to use for each record type on closed cases. That is, the same record type may have different page layouts for open and closed cases. With this additional setting, when users close a case, the case may have a different page layout that exposes how it was closed.
You can't specify custom record types for the home tab. You can only select a page layout assignment for the --Master-- record type.
Profiles
6. Click Save.
SEE ALSO:
How is record type access specified?
Assign Custom Record Types in Permission Sets
Work in the Enhanced Profile User Interface Page
View and Edit Login Hours in the Enhanced Profile User Interface
For each profile, you can specify the hours when users can log in.
1. From Setup, enter
Profiles
in the
Quick Find
box, then select Profiles.
2. Select a profile and click its name.
3. In the profile overview page, scroll down to Login Hours and click Edit.
4. Set the days and hours when users with this profile can log in to the organization.
To allow users to log in at any time, click Clear all times. To prohibit users from using the system on a specific day, set the start and end times to the same value.
If users are logged in when their login hours end, they can continue to view their current page, but they can’t take any further action.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
Custom Profiles available in:
Professional, Enterprise,
Performance, Unlimited, and Developer Editions
USER PERMISSIONS
To view login hour settings:
•
View Setup and
Configuration
To edit login hour settings:
•
Manage Profiles and
Permission Sets
256
Set Up and Maintain Your Salesforce Organization
Note: The first time login hours are set for a profile, the hours are based on the organization’s
Default Time Zone
as specified on the Company Information page in Setup. After that, any changes to the organization’s
Default Time Zone won’t change the time zone for the profile’s login hours. As a result, the login hours are always applied at those exact times even if a user is in a different time zone or if the organization’s default time zone is changed.
Depending on whether you’re viewing or editing login hours, the hours may appear differently. On the Login Hours edit page, hours are shown in your specified time zone. On the profile overview page, they appear in the organization’s original default time zone.
SEE ALSO:
Enhanced Profile User Interface Overview
Restrict Login IP Ranges in the Enhanced Profile User Interface
Control login access at the user level by specifying a range of allowed IP addresses on a user’s profile.
When you define IP address restrictions for a profile, a login from any other IP address is denied.
1. From Setup, enter
Profiles
in the
Quick Find
box, then select Profiles.
2. Select a profile and click its name.
3. In the profile overview page, click Login IP Ranges.
4. Specify allowed IP addresses for the profile.
•
To add a range of IP addresses from which users can log in, click Add IP Ranges. Enter a valid IP address in the
IP Start Address
and a higher-numbered IP address in the
IP End Address
field. To allow logins from only a single IP address, enter the same address in both fields.
•
To edit or remove ranges, click Edit or Delete for that range.
Important:
•
The IP addresses in a range must be either IPv4 or IPv6. In ranges, IPv4 addresses exist in the IPv4-mapped IPv6 address space
::ffff:0:0
to
::ffff:ffff:ffff
, where
::ffff:0:0
is
0.0.0.0
and
::ffff:ffff:ffff
is
255.255.255.255.
A range can’t include IP addresses both inside and outside of the IPv4-mapped IPv6 address space. Ranges like
255.255.255.255
to
::1:0:0:0
or
::
to
::1:0:0:0
aren’t allowed.
•
Partner User profiles are limited to five IP addresses. To increase this limit, contact
Salesforce.
•
The Salesforce Mobile Classic app can bypass IP ranges that are defined for profiles.
Salesforce Mobile Classic initiates a secure connection to Salesforce over the mobile carrier’s network. However, the mobile carrier’s IP addresses can be outside of the IP ranges allowed for the user’s profile. To prevent bypassing IP definitions on a profile,
disable Salesforce Mobile Classic
on page 869 for that user.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
Custom Profiles available in:
Professional, Enterprise,
Performance, Unlimited, and Developer Editions
USER PERMISSIONS
To view login IP ranges:
•
View Setup and
Configuration
To edit and delete login IP ranges:
•
Manage Profiles and
Permission Sets
5. Optionally enter a description for the range. If you maintain multiple ranges, use the Description field to provide details, like which part of your network corresponds to this range.
Note: You can further restrict access to Salesforce to only those IPs in Login IP Ranges. To enable this option, in Setup, enter
Session Settings
in the
Quick Find
box, then select Session Settings and select Enforce login IP ranges on every
request. This option affects all user profiles that have login IP restrictions.
257
Profiles
Set Up and Maintain Your Salesforce Organization
Work in the Original Profile Interface
To view a profile on the original profile page, from Setup, enter
Profiles
in the
Quick Find box, then select Profiles, then select the profile you want.
EDITIONS
On the profile detail page, you can:
•
Available in: Salesforce
Classic and Lightning
Experience
•
Create a profile based on this profile
•
For custom profiles only, click Delete to delete the profile
Note:
You can’t delete a profile that’s assigned to a user, even if the user is inactive.
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
•
View the users who are assigned to this profile
IN THIS SECTION:
Custom Profiles available in:
Professional, Enterprise,
Performance, Unlimited, and Developer Editions
Edit Profiles in the Original Profile Interface
Profiles define how users access objects and data and what they can do within the application.
In standard profiles, you can edit a limited number of settings. In custom profiles, you can edit all available permissions and settings, except the user license.
Profile Settings in the Original Profile Interface
Profiles define how users access objects and data and what they can do within the application. View or edit these settings from the original profile detail page.
Assign Page Layouts in the Original Profile User Interface
If you’re already working in an original profile user interface, you can access, view, and edit all page layout assignments easily in one location.
View and Edit Desktop Client Access in the Original Profile User Interface
Assign Record Types to Profiles in the Original Profile User Interface
After you create record types and include picklist values in them, add record types to user profiles. If you assign a default record type to a profile, users with that profile can assign the record type to records that they create or edit.
View and Edit Login Hours in the Original Profile User Interface
Specify the hours when users can log in based on the user profile.
Restrict Login IP Addresses in the Original Profile User Interface
Control login access at the user level by specifying a range of allowed IP addresses on a user’s profile. When you define IP address restrictions for a profile, a login from any other IP address is denied.
Profiles
258
Set Up and Maintain Your Salesforce Organization
Edit Profiles in the Original Profile Interface
Profiles define how users access objects and data and what they can do within the application. In standard profiles, you can edit a limited number of settings. In custom profiles, you can edit all available permissions and settings, except the user license.
Note: Editing some permissions can result in enabling or disabling other ones. For example, enabling “View All Data” enables “Read” for all objects. Likewise, enabling “Transfer Leads” enables “Read” and “Create” on leads.
Tip:
If enhanced profile list views are enabled for your organization, you can change permissions for multiple profiles from the list view.
1. From Setup, enter
Profiles
in the
Quick Find
box, then select Profiles.
2. Select the profile you want to change.
3. On the profile detail page, click Edit.
SEE ALSO:
Assign Page Layouts in the Original Profile User Interface
Profile Settings in the Original Profile Interface
View and Edit Desktop Client Access in the Original Profile User Interface
Assign Record Types to Profiles in the Original Profile User Interface
View and Edit Login Hours in the Original Profile User Interface
Restrict Login IP Addresses in the Original Profile User Interface
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
Custom Profiles available in:
Professional, Enterprise,
Performance, Unlimited, and Developer Editions
USER PERMISSIONS
To edit profiles:
•
Manage Profiles and
Permission Sets
AND
Customize Application
Profiles
259
Set Up and Maintain Your Salesforce Organization
Profile Settings in the Original Profile Interface
Profiles define how users access objects and data and what they can do within the application.
View or edit these settings from the original profile detail page.
Setting
Profile name and description (custom profiles only)
To view or edit, go to
Profile Detail
Administrative and general permissions (custom profiles only)
Administrative Permissions
App visibility settings Custom App Settings
Console layouts for all profiles
Custom permissions
Desktop client access settings
External data sources
Console Settings
Enabled Custom Permissions
Desktop Integration Clients
Enabled External Data Source Access
Field access in objects
Login hours
Login IP address ranges
Field-Level Security
Login Hours
Login IP Ranges section, click New, or click Edit next to an existing IP range.
Note: You can further restrict access to
Salesforce to only those IPs in Login IP
Ranges. To enable this option, in Setup, enter
Session Settings
in the
Quick Find
box, then select Session
Settings and select Enforce login IP
ranges on every request. This option affects all user profiles that have login IP restrictions.
Object permissions
Page layouts
Record types
Tab visibility settings
Executable Apex classes
Executable Visualforce pages
Standard Object Permissions
Page Layouts
Record Type Settings section. You see the Edit link only if record types exist for the object.
Tab Settings
Enabled Apex Class Access
Enabled Visualforce Page Access
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
Custom Profiles available in:
Professional, Enterprise,
Performance, Unlimited, and Developer Editions
USER PERMISSIONS
To edit profiles:
•
Manage Profiles and
Permission Sets
AND
Customize Application
Profiles
260
Set Up and Maintain Your Salesforce Organization
Setting
Service presence statuses
To view or edit, go to
Enabled Service Presence Status Access
SEE ALSO:
Edit Profiles in the Original Profile Interface
Assign Page Layouts in the Original Profile User Interface
If you’re already working in an original profile user interface, you can access, view, and edit all page layout assignments easily in one location.
1. From Setup, enter
Profiles
in the
Quick Find
box, then select Profiles.
2. Select a profile.
3. Click View Assignment next to any tab name in the Page Layouts section.
4. Click Edit Assignment.
5. Use the table to specify the page layout for each profile. If your organization uses record types, a matrix displays a page layout selector for each profile and record type.
•
Selected page layout assignments are highlighted.
•
Page layout assignments you change are italicized until you save your changes.
6. If necessary, select another page layout from the
Page Layout To Use
drop-down list and repeat the previous step for the new page layout.
7. Click Save.
SEE ALSO:
Work in the Original Profile Interface
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Enterprise,
Performance, Unlimited, and Developer Editions
Record types available in:
Professional, Enterprise,
Performance, Unlimited, and Developer Editions
USER PERMISSIONS
To assign page layouts in profiles:
•
Manage Profiles and
Permission Sets
Profiles
261
Set Up and Maintain Your Salesforce Organization
View and Edit Desktop Client Access in the Original Profile User Interface
Connect Offline and Connect for Office are desktop clients that integrate Salesforce with your PC.
As an administrator, you can control which desktop clients your users can access as well as whether users are automatically notified when updates are available.
Note: To access desktop clients, users must also have the “API Enabled” permission.
1. From Setup, enter
Profiles
in the
Quick Find
box, then select Profiles.
2. Click Edit next to a profile name, and scroll to the Desktop Integration Clients section at the bottom of the page.
SEE ALSO:
Work in the Original Profile Interface
EDITIONS
Connect Offline available in:
Salesforce Classic
Connect Offline available in:
Professional, Enterprise,
Performance, Unlimited, and Developer Editions
Connect for Office available in: both Salesforce Classic and Lightning Experience
Connect for Office available in: All Editions except
Database.com
USER PERMISSIONS
To view desktop client access settings:
•
View Setup and
Configuration
To edit desktop client access settings:
•
Manage Profiles and
Permission Sets
Assign Record Types to Profiles in the Original Profile User Interface
After you create record types and include picklist values in them, add record types to user profiles.
If you assign a default record type to a profile, users with that profile can assign the record type to records that they create or edit.
Note: Users can view records of any record type, even if the record type is not associated with their profile.
You can associate several record types with a profile. For example, a user needs to create hardware and software sales opportunities. In this case, you can create and add both “Hardware” and “Software” record types to the user’s profile.
1. From Setup, enter
Profiles
in the
Quick Find
box, then select Profiles.
2. Select a profile. The record types available for that profile are listed in the Record Type Settings section.
3. Click Edit next to the appropriate type of record.
4. Select a record type from the Available Record Types list and add it to the Selected Record Types list.
EDITIONS
Available in: both Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, and Developer
Editions
USER PERMISSIONS
To assign record types to profiles:
•
Customize Application
Profiles
262
Set Up and Maintain Your Salesforce Organization
Master is a system-generated record type that's used when a record has no custom record type associated with it. When you assign
Master
, users can't set a record type to a record, such as during record creation. All other record types are custom record types.
5. From
Default
, choose a default record type.
If your organization uses person accounts, this setting also controls which account fields display in the
Quick Create
area of the accounts home page.
6. If your organization uses person accounts, set default record type options for both person accounts and business accounts. From the
Business Account Default Record Type
and then the
Person Account Default Record Type drop-down list, choose a default record type.
These settings are used when defaults are needed for both kinds of accounts, such as when converting leads.
7. Click Save.
Options in the Record Type Settings section are blank wherever no record types exist. For example, if you have two record types for opportunities but no record types for accounts, the Edit link only displays for opportunities. In this example, the picklist values and default value for the master are available in all accounts.
Note: If your organization uses person accounts, you can view the record type defaults for business accounts and person accounts.
Go to Account Record Type Settings in the profile detail page. Clicking Edit in the Account Record Type Settings is another way to begin setting record type defaults for accounts.
SEE ALSO:
How is record type access specified?
Work in the Original Profile Interface
Assign Custom Record Types in Permission Sets
View and Edit Login Hours in the Original Profile User Interface
Specify the hours when users can log in based on the user profile.
1. From Setup, enter
Profiles
in the
Quick Find
box, then select Profiles, and select a profile.
2. Click Edit in the Login Hours related list.
3. Set the days and hours when users with this profile can use the system.
To allow users to log in at any time, click Clear All Times. To prohibit users from using the system on a specific day, set the start and end times to the same value.
If users are logged in when their login hours end, they can continue to view their current page, but they can’t take any further action.
4. Click Save.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Enterprise,
Performance, Unlimited,
Developer, and
Database.com Editions
USER PERMISSIONS
To set login hours:
•
Manage Profiles and
Permission Sets
Profiles
263
Set Up and Maintain Your Salesforce Organization
Note: The first time login hours are set for a profile, the hours are based on the organization’s
Default Time Zone
as specified on the Company Information page in Setup. After that, any changes to the organization’s
Default Time Zone won’t change the time zone for the profile’s login hours. As a result, the login hours are always applied at those exact times even if a user is in a different time zone or if the organization’s default time zone is changed.
Depending on whether you’re viewing or editing login hours, the hours appear differently. On the profile detail page, hours are shown in your specified time zone. On the Login Hours edit page, they appear in the organization’s default time zone.
SEE ALSO:
Work in the Original Profile Interface
Restrict Login IP Addresses in the Original Profile User Interface
Restrict Login IP Addresses in the Original Profile User Interface
Control login access at the user level by specifying a range of allowed IP addresses on a user’s profile.
When you define IP address restrictions for a profile, a login from any other IP address is denied.
EDITIONS
1. How you restrict the range of valid IP addresses on a profile depends on your Salesforce edition.
•
If you’re using an Enterprise, Unlimited, Performance, or Developer edition, from Setup, enter
Profiles
in the
Quick Find
box, then select Profiles, and select a profile.
Available in: Salesforce
Classic and Lightning
Experience
•
If you’re using a Professional, Group, or Personal edition, from Setup, enter
Session
Settings
in the
Quick Find
box, then select Session Settings.
Available in all editions
USER PERMISSIONS
2. Click New in the Login IP Ranges related list.
3. Enter a valid IP address in the in the
IP End Address
IP Start Address
field.
field and a higher-numbered IP address
To view login IP ranges:
•
View Setup and
Configuration
The start and end addresses define the range of allowable IP addresses from which users can log in. To allow logins from a single IP address, enter the same address in both fields.
•
The IP addresses in a range must be either IPv4 or IPv6. In ranges, IPv4 addresses exist in the IPv4-mapped IPv6 address space
::ffff:0:0
to
::ffff:ffff:ffff
, where
::ffff:0:0
is
0.0.0.0
and
::ffff:ffff:ffff
is
255.255.255.255.
To edit and delete login IP ranges:
•
Manage Profiles and
Permission Sets
A range can’t include IP addresses both inside and outside of the IPv4-mapped IPv6 address space. Ranges like
255.255.255.255
to
::1:0:0:0
or
::
to
::1:0:0:0
aren’t allowed.
•
Partner User profiles are limited to five IP addresses. To increase this limit, contact Salesforce.
•
The Salesforce Mobile Classic app can bypass IP ranges that are defined for profiles. Salesforce Mobile Classic initiates a secure connection to Salesforce over the mobile carrier’s network. However, the mobile carrier’s IP addresses can be outside of the IP
on page
869 for that user.
4. Optionally enter a description for the range. If you maintain multiple ranges, use the Description field to provide details, such as which part of your network corresponds to this range.
5. Click Save.
Note: Cache settings on static resources are set to private when accessed via a Force.com site whose guest user's profile has restrictions based on IP range or login hours. Sites with guest user profile restrictions cache static resources only within the browser.
Also, if a previously unrestricted site becomes restricted, it can take up to 45 days for the static resources to expire from the Salesforce cache and any intermediate caches.
Profiles
264
Set Up and Maintain Your Salesforce Organization
Note: You can further restrict access to Salesforce to only those IPs in Login IP Ranges. To enable this option, in Setup, enter
Session Settings
in the
Quick Find
box, then select Session Settings and select Enforce login IP ranges on every
request. This option affects all user profiles that have login IP restrictions.
SEE ALSO:
Set Trusted IP Ranges for Your Organization
View and Edit Login Hours in the Original Profile User Interface
Work in the Original Profile Interface
Standard Profiles
Every org includes standard profiles that you can assign to users. In standard profiles, you can edit some settings.
Every org includes standard profiles. In Professional, Enterprise, Unlimited, Performance, and
Developer Editions, you can use standard profiles or create, edit, and delete custom profiles. In orgs where you can’t create custom profiles (such as Contact Manager and Group Editions), you can assign standard profiles to your users, but you can’t view or edit them.
The following table lists commonly used permissions in standard profiles.
Profile Name
System Administrator
Standard Platform User
Standard Platform One App User
Standard User
Available Permissions
Can configure and customize the application.
Has access to all functionality that does not require an additional license. For example, administrators cannot manage campaigns unless they also have a Marketing User license.
Can manage price books and products. Can edit any quota, override forecasts, and view any forecast.
Can use custom Force.com AppExchange apps developed in your org or installed from
AppExchange. In addition, can use core platform functionality such as accounts, contacts, reports, dashboards, and custom tabs.
Can use one custom AppExchange app developed in your org or installed from
AppExchange. The custom app is limited to five tabs. In addition, can use core platform functionality such as accounts, contacts, reports, dashboards, and custom tabs.
Can create and edit most major types of records, run reports, and view the org's setup. Can view, but not manage, campaigns. Can create, but not review, solutions. Can edit personal quota and override forecasts.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Your edition determines which standard profiles are available.
Profiles
265
Set Up and Maintain Your Salesforce Organization
Profile Name
Customer Community User
Customer Community Plus User
Partner Community User
Customer Portal User
High Volume Customer Portal
Authenticated Website
Customer Portal Manager
Partner User
Solution Manager
Marketing User
Contract Manager
Read Only
Chatter Only User
Available Permissions
Can log in via a community. Your community settings and sharing model determine their access to tabs, objects, and other features.
For more information, see
Can log in via a Customer Portal or a community. Can view and edit data they directly own or data owned by or shared with users below them in the Customer Portal role hierarchy; and they can view and edit cases where they are listed in the
Contact Name field.
Can log in via a Customer Portal or a community.
The High Volume Customer Portal and Authenticated Website profiles are high-volume portal users.
Can log in via a Customer Portal or a community. Can view and edit data they directly own or data owned by or shared with users below them in the Customer Portal role hierarchy; and they can view and edit cases where they are listed in the
Contact Name field.
Can log in via a partner portal or a community.
Can review and publish solutions. Also has access to the same functionality as the Standard User.
Can manage campaigns, create letterheads, create HTML email templates, manage public documents, and add campaign members and update their statuses with the Data Import Wizard. Also has access to the same functionality as the Standard User.
Can create, edit, activate, and approve contracts. This profile can also delete contracts as long as they are not activated. Can edit personal quota and override forecasts.
Can view the org’s setup, run and export reports, and view, but not edit, other records.
Can only log in to Chatter. Can access all standard Chatter people, profiles, groups, and files. Additionally, they can:
•
View Salesforce accounts and contacts
•
Use Salesforce CRM Content, Ideas, and Answers
•
Access dashboards and reports
•
Use and approve workflows
•
Use the calendar to create and track activities
•
View and modify up to ten custom objects
•
Add records to groups
Profiles
266
Set Up and Maintain Your Salesforce Organization
Profile Name
Chatter Free User
Chatter External User
Chatter Moderator User
Site.com Only User
Available Permissions
Note: You must expose the tabs for the standard Salesforce objects that the Chatter Only user profile can access, as they are hidden by default for these users.
Professional Edition organizations must have Profiles enabled to perform these tasks. Contact your Salesforce representative for more information.
Only available with the Chatter Only user license.
For more information on Chatter Plus users, see
Chatter Plus
Frequently Asked Questions
.
Can only log in to Chatter. Can access all standard Chatter people, profiles, groups, and files.
Only available with the Chatter Free user license.
Can only log in to Chatter and access groups they've been invited to and interact with members of those groups. Only available with the Chatter External user license.
Can log in to Chatter. Can access all standard Chatter people, profiles, groups, and files. Additionally, this user can:
•
Activate and deactivate other Chatter Free users and moderators
•
Grant and revoke moderator privileges
•
Delete posts and comments that they can see
•
Edit their own posts and comments
Note:
Changing a user's profile from Chatter Moderator
User to Chatter Free User removes moderator privileges in
Chatter.
Only available with the Chatter Free user license.
Can only log in to the Site.com app. Each Site.com Only user also needs a Site.com Publisher feature license to create and publish sites, or a Site.com Contributor feature license to edit the site’s content.
Additionally, this user can:
•
Use one custom app with up to 20 custom objects
•
Access the Content app, but not the Accounts and Contacts objects
•
Create unlimited custom tabs
Profiles
267
Set Up and Maintain Your Salesforce Organization
Profile Name Available Permissions
Only available with the Site.com Only user license.
SEE ALSO:
Manage Profile Lists
Profiles define how users access objects and data, and what they can do within the application.
When you create users, you assign a profile to each one. To view the profiles in your organization, from Setup, enter
Profiles
in the
Quick Find
box, then select Profiles.
Viewing Enhanced Profile Lists
If enhanced profile list views are enabled for your organization, you can use additional tools to customize, navigate, manage, and print profile lists.
•
Show a filtered list of profiles by selecting a view from the drop-down list.
•
Delete a view by selecting it from the drop-down list and clicking Delete.
•
Create a list view or edit an existing view
.
•
.
•
Print the list view by clicking .
•
Refresh the list view after creating or editing a view by clicking
•
Edit permissions directly in the list view
.
•
View or edit a profile by clicking its name.
•
Delete a custom profile by clicking Del next to its name.
.
Note: You can’t delete a profile that’s assigned to a user, even if the user is inactive.
Viewing the Basic Profile List
•
.
•
View or edit a profile by clicking its name.
•
Delete a custom profile by clicking Del next to its name.
IN THIS SECTION:
Creating and Editing Profile List Views
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
Custom Profiles available in:
Professional, Enterprise,
Performance, Unlimited, and Developer Editions
USER PERMISSIONS
To view profiles, and print profile lists:
•
View Setup and
Configuration
To delete profile list views:
•
Manage Profiles and
Permission Sets
To delete custom profiles:
•
Manage Profiles and
Permission Sets
Profiles
268
Set Up and Maintain Your Salesforce Organization
Edit Multiple Profiles with Profile List Views
If enhanced profile list views are enabled for your organization, you can change permissions in up to 200 profiles directly from the list view, without accessing individual profile pages.
SEE ALSO:
Edit Multiple Profiles with Profile List Views
Creating and Editing Profile List Views
show a set of profiles with the fields you choose. For example, you could create a list view of all profiles in which “Modify All Data” is enabled.
1. In the Profiles page, click Create New View, or select a view and click Edit.
2. Enter the view name.
3. Under Specify Filter Criteria, specify the conditions that the list items must match, such as
Modify All Data equals True
.
a. Type a setting name, or click the lookup icon
to search for and select the setting you want.
b. Choose a filter operator.
c. Enter the value that you want to match.
d. To specify another filter condition, click Add New. You can specify up to 25 filter condition rows.
To remove a filter condition row and clear its values, click the remove row icon .
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
Custom Profiles available in:
Professional, Enterprise,
Performance, Unlimited, and Developer Editions
USER PERMISSIONS
4. Under Select Columns to Display, specify the profile settings that you want to appear as columns in the list view.
a. From the Search drop-down list, select the type of setting you want to search for.
b. Enter part or all of a word in the setting you want to add and click Find.
To create, edit, and delete profile list views:
•
Manage Profiles and
Permission Sets
Note: If the search finds more than 500 values, no results appear. Use the preceding steps to refine your search criteria and show fewer results.
c. To add or remove columns, select one or more column names and click the Add or Remove arrow.
d. Use the Top, Up, Down, and Bottom arrows to arrange the columns in the sequence you want.
You can add up to 15 columns in a single list view.
5. Click Save, or if you're cloning an existing view, rename it and click Save As.
SEE ALSO:
Edit Multiple Profiles with Profile List Views
Profiles
269
Set Up and Maintain Your Salesforce Organization
Edit Multiple Profiles with Profile List Views
If enhanced profile list views are enabled for your organization, you can change permissions in up to 200 profiles directly from the list view, without accessing individual profile pages.
Editable cells display a pencil icon ( ) when you hover over the cell, while non-editable cells display a lock icon ( ). In some cases, such as in standard profiles, the pencil icon appears but the setting is not actually editable.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Warning: Use care when editing profiles with this method. Because profiles affect a user's fundamental access, making mass changes may have a widespread effect on users in your organization.
1. Select or create a list view that includes the profiles and permissions you want to edit.
2. To edit multiple profiles, select the checkbox next to each profile you want to edit.
If you select profiles on multiple pages, Salesforce remembers which profiles are selected.
Available in: Enterprise,
Performance, Unlimited,
Developer, and
Database.com Editions
USER PERMISSIONS
3. Double-click the permission you want to edit.
For multiple profiles, double-click the permission in any of the selected profiles.
4. In the dialog box that appears, enable or disable the permission.
In some cases, changing a permission may also change other permissions. For example, if
“Customize Application” and “View Setup and Configuration” are disabled and you enable
“Customize Application,” then “View Setup and Configuration” is also enabled. In this case, the dialog box lists the affected permissions.
To edit multiple profiles from the list view:
•
Manage Profiles and
Permission Sets
AND
Customize Application
5. To change multiple profiles, select All
n
selected records (where
n
is the number of profiles you selected).
6. Click Save.
Note:
•
For standard profiles, inline editing is available only for the “Single Sign-On” and “Affected By Divisions” permissions.
•
If you edit multiple profiles, only those profiles that support the permission you are changing will change. For example, if you use inline editing to add “Modify All Data” to multiple profiles, but because of its user license the profile doesn't have “Modify
All Data,” the profile won't change.
If any errors occur, an error message appears, listing each profile in error and a description of the error. Click the profile name to open the profile detail page. The profiles you've clicked appear in the error window in gray, strike-through text. To view the error console, you must have pop-up blockers disabled for the Salesforce domain.
Any changes you make are recorded in the setup audit trail.
SEE ALSO:
Profiles
270
Set Up and Maintain Your Salesforce Organization
Clone Profiles
Instead of creating profiles, save time by cloning existing profiles and customizing them.
Tip: If you clone profiles to enable certain permissions or access settings, consider using permission sets. For more information, see
Permission Sets . Also, if your profile name contains
more than one word, avoid extraneous spacing. For example, “Acme User” and “Acme User” are identical other than spacing between “Acme” and “User.” Using both profiles in this case can result in confusion for admins and users.
1. From Setup, enter
Profiles
in the
Quick Find
box, then select Profiles.
2. In the Profiles list page, do one of the following:
•
Click New Profile, then select an existing profile that’s similar to the one you want to create.
•
If enhanced profile list views are enabled, click Clone next to a profile that’s similar to the one you want to create.
•
Click the name of a profile that’s similar to the one you want to create, then in the profile page, click Clone.
A new profile uses the same user license as the profile it was cloned from.
3. Enter a profile name.
4. Click Save.
SEE ALSO:
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
Custom Profiles available in:
Professional, Enterprise,
Performance, Unlimited, and Developer Editions
USER PERMISSIONS
To create profiles:
•
Manage Profiles and
Permission Sets
Viewing a Profile's Assigned Users
To view all users that are assigned to a profile from the profile overview page, click Assigned Users
(in the enhanced profile user interface) or View Users (in the original profile user interface). From the assigned users page, you can:
•
•
Reset passwords for selected users
•
•
View a user's detail page by clicking the name, alias, or username
•
View or edit a profile by clicking the profile name
•
If Google Apps
™
is enabled in your organization, export users to Google and create Google
Apps accounts by clicking Export to Google Apps
SEE ALSO:
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
Custom Profiles available in:
Professional, Enterprise,
Performance, Unlimited, and Developer Editions
Profiles
271
Set Up and Maintain Your Salesforce Organization
Edit Object Permissions in Profiles
Object permissions specify the type of access that users have to objects.
1. From Setup, either:
•
Enter
Permission Sets
in the
Quick Find
box, then select Permission Sets, or
•
Enter
Profiles
in the
Quick Find
box, then select Profiles
2. Select a permission set or profile.
3. Depending on which interface you're using, do one of the following:
•
Permission sets or enhanced profile user interface—In the Find Settings... box, enter the name of the object and select it from the list. Click Edit, then scroll to the Object Permissions section.
•
Original profile user interface—Click Edit, then scroll to the Standard Object Permissions,
Custom Object Permissions, or External Object Permissions section.
4. Specify the object permissions.
5. Click Save.
SEE ALSO:
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Contact
Manager, Professional,
Group, Enterprise,
Performance, Unlimited,
Developer, and
Database.com Editions
USER PERMISSIONS
To view object permissions:
•
View Setup and
Configuration
To edit object permissions:
•
Manage Profiles and
Permission Sets
AND
Customize Application
Profiles
272
Set Up and Maintain Your Salesforce Organization
View and Edit Tab Settings in Permission Sets and Profiles
Tab settings specify whether a tab appears in the All Tabs page or is visible in a tab set.
1. From Setup, either:
•
Enter
Permission Sets
in the
Quick Find
box, then select Permission Sets, or
•
Enter
Profiles
in the
Quick Find
box, then select Profiles
2. Select a permission set or profile.
3. Do one of the following:
•
Permission sets or enhanced profile user interface—In the Find Settings... box, enter the name of the tab you want and select it from the list, then click Edit.
•
Original profile user interface—Click Edit, then scroll to the Tab Settings section.
4.
5. (Original profile user interface only) To reset users’ tab customizations to the tab visibility settings that you specify, select Overwrite users' personal tab customizations.
6. Click Save.
Note:
If Salesforce CRM Content is enabled for your organization but the Salesforce CRM
Content User checkbox isn’t enabled on the user detail page, the Salesforce CRM Content app has no tabs.
IN THIS SECTION:
Tab settings specify whether a tab appears in the All Tabs page or is visible in its associated app. They also determine whether objects appear in the Lightning Experience App Launcher and navigation menus. Tab settings labels in permission sets differ from the labels in profiles.
EDITIONS
Available in: both Salesforce
Classic and Lightning
Experience
Tab settings available in: All
Editions except
Database.com
Permission sets available in:
Contact Manager,
Professional, Group,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
Profiles available in:
Professional, Enterprise,
Performance, Unlimited,
Developer, and
Database.com Editions
USER PERMISSIONS
To view tab settings:
•
View Setup and
Configuration
To edit tab settings:
•
Manage Profiles and
Permission Sets
SEE ALSO:
Profiles
273
Set Up and Maintain Your Salesforce Organization
Tab Settings
Tab settings specify whether a tab appears in the All Tabs page or is visible in its associated app.
They also determine whether objects appear in the Lightning Experience App Launcher and navigation menus. Tab settings labels in permission sets differ from the labels in profiles.
Enabled Setting in Profiles Description Enabled Settings in
Permission Sets
Available Default Off
Available
and
Visible Default On
None
Tab Hidden
The tab is available on the All
Tabs page. Individual users can customize their display to make the tab visible in any app.
The tab is available on the All
Tabs page and appears in the visible tabs for its associated app. In Lightning Experience, this setting determines whether an object appears in the App Launcher and in navigation menus. Individual users can customize their display to hide the tab or make it visible in other apps.
The tab isn’t available on the
All Tabs page or visible in any apps.
EDITIONS
Available in: both Salesforce
Classic and Lightning
Experience
Tab settings available in: All
Editions except
Database.com
Permission sets available in:
Contact Manager,
Professional, Group,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
Profiles available in:
Professional, Enterprise,
Performance, Unlimited,
Developer, and
Database.com Editions
Profiles
Note:
If a user has another permission set or profile with enabled settings for the same tab, the most permissive setting applies.
For example, let’s say permission set A has no settings enabled for the Accounts tab, and permission set B enables the
Available setting for the Accounts tab. If permission sets A and B are assigned to a user, the user sees the Accounts tab on the All Tabs page.
SEE ALSO:
View and Edit Tab Settings in Permission Sets and Profiles
274
Set Up and Maintain Your Salesforce Organization
View and Edit Assigned Apps in Profiles
Assigned app settings specify the apps that users can select in the Force.com app menu.
Every profile must have at least one visible app, except profiles associated with Customer Portal users because apps are not available to them.
To specify app visibility:
1. From Setup, enter
Profiles
in the
Quick Find
box, then select Profiles.
2. Select a profile.
3. Depending on which user interface you're using, do one of the following:
•
Enhanced profile user interface—Click Assigned Apps, then click Edit.
•
Original profile user interface—Click Edit, then scroll to the Custom App Settings section.
4. Select one default app. The default app appears when users log in for the first time.
5. Select Visible for any other apps you want to make visible.
SEE ALSO:
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
Custom Profiles available in:
Professional, Enterprise,
Performance, Unlimited, and Developer Editions
USER PERMISSIONS
To edit app visibility settings:
•
Manage Profiles and
Permission Sets
Enable Custom Permissions in Profiles
Custom permissions give you a way to provide access to custom processes or apps. After you’ve created a custom permission and associated it with a process or app, you can enable the permission in profiles.
1. From Setup, enter
Profiles
in the
Quick Find
box, then select Profiles.
2. Select a profile.
3. Depending on which user interface you’re using, do one of the following.
•
Enhanced profile user interface: Click Custom Permissions, and then click Edit.
•
Original profile user interface: In the Enabled Custom Permissions related list, click Edit.
4. To enable custom permissions, select them from the Available Custom Permissions list and click Add. To remove custom permissions from the profile, select them from the Enabled Custom
Permissions list and click Remove.
5. Click Save.
EDITIONS
Available in: both Salesforce
Classic and Lightning
Experience
Available in: Group,
Professional, Enterprise,
Performance, Unlimited, and Developer Editions
In Group and Professional
Edition organizations, you can’t create or edit custom permissions, but you can install them as part of a managed package.
USER PERMISSIONS
To enable custom permissions in profiles:
•
Manage Profiles and
Permission Sets
Profiles
275
Set Up and Maintain Your Salesforce Organization
View and Edit Session Timeout Settings in Profiles
Use Session Settings to set how many minutes or hours of inactivity elapse before a user’s authentication session times out. At the end of the session, the user needs to log in again.
Until you set the
Session times out after
value on a profile, the
Timeout value in the organization Session Settings applies to users of the profile. When set, the profile
Session times out after
value overrides the org-wide
Timeout value
. Changes to the org-wide
Timeout value
don’t apply to users of a profile with its own
Session times out after
value.
1. From Setup, enter
Profiles
in the
Quick Find
box, then select Profiles.
2. Select a profile.
3. Depending on which user interface you’re using, do one of the following.
•
Enhanced profile user interface—Click Session Settings, then click Edit.
•
Original profile user interface—Click Edit, then scroll to the Session Settings section.
4. Select a timeout value from the drop-down list.
5. Click Save.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
Custom Profiles available in:
Professional, Enterprise,
Performance, Unlimited, and Developer Editions
USER PERMISSIONS
To edit session and password settings in profiles:
•
Manage Profiles and
Permission Sets
Profiles
276
Set Up and Maintain Your Salesforce Organization
View and Edit Password Policies in Profiles
To ensure that the appropriate level of password security is used for your organization, specify password requirements with Password Policies settings for users assigned to a profile. Profile
Password Policies settings override the organization-wide Password Policies for that profile’s users.
If you do not set Password Policies on a profile, the organization-wide Password Policies apply. New profile Password Policies take effect for existing profile users when they reset their passwords.
Changes to the organization-wide Password Policies don’t apply to users of a profile with its own
Password Policies.
1. From Setup, enter
Profiles
in the
Quick Find
box, then select Profiles.
2. Select a profile.
3. Depending on which user interface you’re using, do one of the following.
•
Enhanced profile user interface—Click Password Policies, then click Edit.
•
Original profile user interface—Click Edit, then scroll to the Password Policies section.
4. Change the values for the profile.
Note: If you change the
User passwords expire in
setting, the change affects a user’s password expiration date if that user’s new expiration date is earlier than the old expiration date or if you remove an expiration by selecting
Never expires
.
5. Click Save.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
Custom Profiles available in:
Professional, Enterprise,
Performance, Unlimited, and Developer Editions
SEE ALSO:
Password Policy Fields in Profiles
USER PERMISSIONS
To edit session and password settings in profiles:
•
Manage Profiles and
Permission Sets
To set password policies:
•
Manage Password
Policies
Password Policy Fields in Profiles
Specify password requirements with Password Policies settings. Refer to these field descriptions to understand how each one impacts a profile’s password requirements.
Changes to the organization-wide password policies don’t apply to users of a profile with its own password policies.
Field
User passwords expire in
Enforce password history
Description
The length of time until user passwords expire and must be changed. The default is 90 days. This setting isn’t available for
Self-Service portals. This setting doesn’t apply to users with the
“Password Never Expires” permission.
If you change the
User passwords expire in
setting, the change affects a user’s password expiration date if that user’s new expiration date is earlier than the old expiration date or if you remove an expiration by selecting
Never expires
.
Save users’ previous passwords so that they must always reset their password to a new, unique password. Password history is not saved until you set this value. The default is
3 passwords remembered
. You cannot select
No passwords
Profiles
277
Set Up and Maintain Your Salesforce Organization
Field
Minimum password length
Password complexity requirement
Password question requirement
Maximum invalid login attempts
Lockout effective period
Description
remembered
unless you select
Never expires
for the
User passwords expire in
field. This setting isn’t available for Self-Service portals.
The minimum number of characters required for a password. When you set this value, existing users aren’t affected until the next time they change their passwords. The default is
8 characters
.
The requirement for which types of characters must be used in a user’s password.
Complexity levels:
•
No restriction
—allows any password value and is the least secure option.
•
Must mix alpha and numeric characters
—requires at least one alphabetic character and one number, which is the default.
•
Must mix alpha, numeric, and special characters
—requires at least one alphabetic character, one number, and one of the following special characters:
!
# $ % - _ = + < >
.
•
Must mix numbers and uppercase and lowercase letters
—requires at least one number, one uppercase letter, and one lowercase letter.
•
Must mix numbers, uppercase and lowercase letters, and special characters
—requires at least one number, one uppercase letter, and one lowercase letter, and one of the following special characters:
! # $ % - _ = + < >
.
Note:
Only the special characters listed meet the requirement. Other symbol characters are not considered special characters.
The values are
Cannot contain password
, meaning that the answer to the password hint question cannot contain the password itself; or
None
, the default, for no restrictions on the answer. The user’s answer to the password hint question is required.
This setting is not available for Self-Service portals, Customer Portals, or partner portals.
The number of login failures allowed for a user before they become locked out. This setting isn’t available for Self-Service portals.
The duration of the login lockout. The default is 15 minutes. This setting isn’t available for Self-Service portals.
Note: If users are locked out, they must wait until the lockout period expires. Alternatively, a user with the “Reset
Profiles
278
Set Up and Maintain Your Salesforce Organization
Field Description
User Passwords and Unlock Users” permission can unlock them from Setup with the following procedure:
1. Enter
Users
in the
Quick Find
box.
2. Select Users.
3. Selecting the user.
4. Click Unlock.
This button is only available when a user is locked out.
Obscure secret answer for password resets
This feature hides answers to security questions as you type. The default is to show the answer in plain text.
Note: If your org uses the Microsoft Input Method Editor
(IME) with the input mode set to Hiragana, when you type
ASCII characters, they’re converted in Japanese characters in normal text fields. However, the IME doesn’t work properly in fields with obscured text. If your org’s users cannot properly enter their passwords or other values after enabling this feature, disable the feature.
Require a minimum 1 day password lifetime
When you select this option, a password can’t be changed more than once in a 24-hour period.
SEE ALSO:
View and Edit Password Policies in Profiles
Permission Sets
A permission set is a collection of settings and permissions that give users access to various tools and functions. The settings and permissions in permission sets are also found in profiles, but permission sets extend users’ functional access without changing their profiles.
Users can have only one profile but, depending on the Salesforce edition, they can have multiple permission sets. You can assign permission sets to various types of users, regardless of their profiles.
Create permission sets to grant access among logical groupings of users, regardless of their primary job function. For example, let’s say you have several users with a profile called Sales User. This profile allows assignees to read, create, and edit leads. Some, but not all, of these users also need to delete and transfer leads. Instead of creating another profile, create a permission set.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Contact
Manager, Professional,
Group, Enterprise,
Performance, Unlimited,
Developer, and
Database.com Editions
Profiles
279
Set Up and Maintain Your Salesforce Organization
Or, let’s say you have an Inventory custom object in your org. Many users need “Read” access to this object, and a smaller number of users need “Edit” access. You can create a permission set that grants “Read” access and assign it to the appropriate users. You can then create another permission set that gives “Edit” access to the Inventory object and assign it to the smaller group of users.
If a permission isn’t enabled in a profile but is enabled in a permission set, users with that profile and permission set have the permission.
For example, if “Manage Password Policies” isn’t enabled in Jane Smith’s profile but is enabled in one of her permission sets, she can manage password policies.
IN THIS SECTION:
You can clone a permission set or create a new one. A cloned permission set starts with the same licenses and enabled permissions as the original one. A new permission set starts with no licenses selected and no permissions enabled.
Assign Permission Sets to a Single User
Assign permission sets or remove permission set assignments for a single user from the user detail page.
A standard permission set consists of a group of common permissions for a particular feature associated with a permission set license.
Using a standard permission set saves you time and facilitates administration because you don’t need to create the custom permission set.
Create session-based permission sets that allow access only during specified sessions. For example, create a session-based permission set that grants access to an application only during an authenticated session.
Permission Sets Considerations
Be aware of these considerations and special behaviors for permission sets.
SEE ALSO:
Assign a Feature Permission Set License and Permission Set
Profiles
280
Set Up and Maintain Your Salesforce Organization
Create Permission Sets
You can clone a permission set or create a new one. A cloned permission set starts with the same licenses and enabled permissions as the original one. A new permission set starts with no licenses selected and no permissions enabled.
EDITIONS
1. From Setup, enter
Permission Sets
in the
Quick Find
box, then select Permission
Sets.
Available in: Salesforce
Classic and Lightning
Experience
2. Click New.
3. Enter your permission set information.
4. Select the types of users for the permission set.
When you create a permission set, you select a specific user or permission set license. If only users with one type of license can use the permission set, select the license that’s associated with the users. For example, to create a permission set for users with
•
the Salesforce license, select Salesforce. You can enable permissions only allowed in the
Salesforce license.
•
the Identity Connect permission set license, select Identity Connect. You can enable permissions only allowed in the Identity Connect license.
•
different licenses, select None. Not selecting a specific license allows you to assign the permission set to any user whose license allows the permissions you enable in the permission set. For example, to assign the permission set to users with the Salesforce license and to users with the Salesforce Platform license, select None.
Available in: Contact
Manager, Professional,
Group, Enterprise,
Performance, Unlimited,
Developer, and
Database.com Editions
USER PERMISSIONS
To create permission sets:
•
“Manage Profiles and
Permission Sets”
To assign permission sets:
•
“Assign Permission Sets”
When creating a permission set for a specific permission set license, refer to that feature’s documentation. For example, to create a permission set for the Identity Connect permission set license, use these steps along with the Identity Connect documentation.
Example: Let’s say you have several users with a profile called Sales User. This profile allows assignees to read, create, and edit leads. But you need some users to also delete and transfer leads. On the permission set page that you create, go to Find Settings and begin typing
Lead
. Under Object Settings, select Leads and enable delete. “Transfer Leads” is an app permission (rather than object permission). To enable it, in Find Settings, begin typing
leads
. “Transfer Leads” is listed under App Permissions. Assign the permission set to users who need these permissions.
Note:
•
Permission sets with no license selected don’t include all possible permissions and settings.
•
Assign a permission set with no license only to users whose user licenses allow the permissions and settings that you are enabling in the permission set. For example, don’t create a permission set with no user license and then enable
“Author Apex” and assign it to Salesforce Platform users. You can’t assign this permission set to Salesforce Platform users because the Salesforce Platform user license doesn’t allow Apex authoring.
Profiles
SEE ALSO:
Assign a Feature Permission Set License and Permission Set
What Are Permission Set Licenses?
281
Set Up and Maintain Your Salesforce Organization
Assign Permission Sets to a Single User
Assign permission sets or remove permission set assignments for a single user from the user detail page.
The Permission Set Assignments page shows:
•
Permission sets with no associated license. For example, you can assign a permission set if None was selected for the license type in the permission set. Make sure that the user’s license allows all the permission set’s enabled settings and permissions. If the user’s license doesn’t allow selected permissions, the assignment fails.
•
Permission sets that match the user’s license. For example, if a user’s license is Chatter Only, you can assign permission sets with the Chatter Only license.
•
Permission sets specific to permission set licenses. Let’s say you create a permission set named
Identity and associate that permission set to the “Identity Connect” permission set license. When you assign users to Identity, they receive all functionality available with the Identity Connect permission set license.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Contact
Manager, Professional,
Group, Enterprise,
Performance, Unlimited,
Developer, and
Database.com Editions
USER PERMISSIONS
Note: Some permissions require users to have a permission set license before you can grant the permissions. For example, if you add the “Use Identity Connect” user permission to the
Identity permission set, you can assign only users with the Identity Connect permission set license to the permission set.
1. From Setup, enter
Users
in the
Quick Find
box, then select Users.
2. Select a user.
To assign permission sets:
•
“Assign Permission Sets”
3. In the Permission Set Assignments related list, click Edit Assignments.
4. To assign a permission set, select it under Available Permission Sets and click Add. To remove a permission set assignment, select it under Enabled Permission Sets and click Remove.
5. Click Save.
Tip:
You can perform this and other administration tasks from the SalesforceA mobile app.
SEE ALSO:
Assign a Permission Set to Multiple Users
Help Users From Anywhere With SalesforceA
Assign a Permission Set to Multiple Users
Profiles
282
Set Up and Maintain Your Salesforce Organization
Standard Permission Sets
A standard permission set consists of a group of common permissions for a particular feature associated with a permission set license. Using a standard permission set saves you time and facilitates administration because you don’t need to create the custom permission set.
The following permission set license comes with a standard permission set. To enable specific features, refer to that feature’s documentation.
Permission Set License Name
Sales Console User in Salesforce Classic
Permission Set Name
Salesforce Console User in Salesforce Classic
To see which permission sets are standard, add
Is Custom
to your list view. The Is Custom box isn’t checked for standard permission set. Permission sets you created or cloned are indicated with a checkmark.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Contact
Manager, Professional,
Group, Enterprise,
Performance, Unlimited,
Developer, and
Database.com Editions
Profiles
Standard permission sets don’t count against your org’s permission set limits. You can clone a standard permission set as many times as you want, but you can’t edit it. Clones do count against your org’s permission set limits.
Example: Let’s say you purchased 10 Sales Console User permission set licenses. You can do any of the following.
•
Assign all 10 users to the Salesforce Console User permission set.
•
Assign some of the users to the Salesforce Console User permission set, and assign the remainder to a clone of Salesforce
Console User.
•
Clone the Salesforce Console User permission set and assign different users to each clone, based on your org’s structure.
283
Set Up and Maintain Your Salesforce Organization
Session-based Permission Sets
Create session-based permission sets that allow access only during specified sessions. For example, create a session-based permission set that grants access to an application only during an authenticated session.
IN THIS SECTION:
What Are Session-Based Permission Sets?
Session-based permission sets apply to a specific session. Understand why and when to create a session-based permission set.
Create a Flow That Can Activate or Deactivate a Session-Based Permission Set
You can create a session-based permission set and then create a flow that users can run to activate or deactivate the permission set themselves.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Contact
Manager, Professional,
Group, Enterprise,
Performance, Unlimited,
Developer, and
Database.com Editions
What Are Session-Based Permission Sets?
Session-based permission sets apply to a specific session. Understand why and when to create a session-based permission set.
EDITIONS
Use a session-based permission set to allow functional access only during a predefined session type. For example, let’s say your org has a custom object called Conference Room. A mobile app called Conference Room Sync has read and update access to the object. You can create a permission set to allow updates to the object only when the Conference Room Sync connected mobile app generates the user’s session.
Available in: Salesforce
Classic and Lightning
Experience
In another example, you have a web application that accesses confidential information. For security, you want to limit user access to specific types of sessions for a predetermined length of time. You can create a session-based permission set that activates only when users authenticate into your environment using a token. When the token expires, the user must reauthenticate to access the application again.
Available in: Contact
Manager, Professional,
Group, Enterprise,
Performance, Unlimited,
Developer, and
Database.com Editions
For this example, you have a junior buyer in your org who occasionally requires access to your Contracts object. Create a session-based permission set with access to the object, and then create a flow that uses the Activate Session-Based Permission Set action available in the Cloud Flow Designer. In the flow, pass the permission name to the action. During runtime, the action checks who’s running the flow.
When the junior buyer runs the flow, the activation process fires. When the flow completes, the buyer has access to the Contracts object for the current session.
To activate session-based permission sets via the SOAP API, see the SessionPermSetActivation object in the SOAP API Developer Guide .
You need the Manage Session Permission Set Activation permission.
Before assigning session-based permission sets to users, ensure that they can meet the conditions of the permission set. For example, grant user access to appropriate tools, such as authenticators. As a best practice, inform users of the conditions in which they can access certain applications and tools.
Tip: When you create your permission set list view, select columns to include Session Activation Required to view which permission sets are session-based.
User assignment information appears on the user detail page in a related list called Permission Set Assignments: Activation Required.
Profiles
284
Set Up and Maintain Your Salesforce Organization
SEE ALSO:
Create a Flow That Can Activate or Deactivate a Session-Based Permission Set
Create a Flow That Can Activate or Deactivate a Session-Based Permission Set
You can create a session-based permission set and then create a flow that users can run to activate or deactivate the permission set themselves.
Before beginning, check out
What Are Session-Based Permission Sets? to learn when to use them.
Important: You can run queries, however, do not make data or object updates in flows that also activate session-based permission sets.
1.
and make sure to select Session Activation Required
2.
Assign the permission set to users
.
3. Create a flow.
a. In the Cloud Flow Designer, select the Activate Session-Based Permission Set or
Deactivate Session-Based Permission Set action. Descriptions of the actions are in the palette.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Contact
Manager, Professional,
Group, Enterprise,
Performance, Unlimited,
Developer, and
Database.com Editions
USER PERMISSIONS
To create permission sets:
•
Manage Profiles and
Permission Sets
To assign permission sets:
•
Assign Permission Sets
To open, edit, or create a flow in the Cloud Flow
Designer:
•
Manage Force.com Flow
Profiles
285
Set Up and Maintain Your Salesforce Organization Profiles
b. In the flow, pass the permission name to the action.
4. Activate your flow.
286
Set Up and Maintain Your Salesforce Organization
5. Distribute your flow to users who need to run it.
Example: Create a flow to pass a permission name to the Activate Session-Based Permission Set action. First, add a record lookup element to your flow to look up the PermissionSet object. Set the Name field to the name of your session-based permission set.
Then add the Activate Session-Based Permission Set action, and set the input to your permission set name.
Tip: Make sure that users who want to run your flow have the Run Flows permission.
When the flow activates the session-based permission set, the running user obtains access to the permissions specified in your permission set during the current user session. If the flow deactivates the session-based permission set, the permissions are no longer available to the user.
SEE ALSO:
What Are Session-Based Permission Sets?
Permission Sets Considerations
Be aware of these considerations and special behaviors for permission sets.
Differences between new and cloned permission sets
A new permission set starts with no user license selected and no permissions enabled. A cloned permission set has the same user license and enabled permissions as the permission set that it’s cloned from. You can’t change the user license in a cloned permission set. Clone a permission set only if the new one requires the same user license as the original.
Limits
Make sure to refer to the Salesforce Features and Editions Limits for your specific edition.
User license restrictions
Some user licenses restrict the number of custom apps or tabs that a user can access. In this case, you can assign only the allotted number through the user’s assigned profile and permission sets. For example, a user with the Force.com App Subscription user license with access to one
Force.com Light App can access only that app’s custom tabs.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Contact
Manager, Professional,
Group, Enterprise,
Performance, Unlimited,
Developer, and
Database.com Editions
Assigned apps
Assigned app settings specify the apps that users can select in the Force.com app menu. Unlike profiles, you can’t assign a default app in permission sets. You can only specify whether apps are visible.
Permission sets and profiles
In API version 25.0 and later, every profile is automatically associated with a permission set, whether you explicitly assign it to one or not. This permission set stores the profile’s user, object, and field permissions, plus setup entity access settings. You can query on these profile-owned permission sets but not modify them. They’re not visible in the user interface.
Permission sets and permission set licenses
In API version 38.0 and later, you can create a permission set and associate it with a permission set license. When you create a permission set using a specific permission set license, users assigned to the permission set receive all functionality associated with the permission set license.
Apex class access
You can specify which methods in a top-level Apex class are executable for a permission set. Apex class access settings apply only to:
•
Apex class methods, such as Web service methods
Profiles
287
Set Up and Maintain Your Salesforce Organization
•
Any method used in a custom Visualforce controller or controller extension applied to a Visualforce page
Triggers always fire on trigger events (such as insert
or update
), regardless of permission settings.
SEE ALSO:
How is record type access specified?
Permission Set Overview Page
A permission set's overview page provides an entry point for all of the permissions in a permission set. To open a permission set overview page, from Setup, enter
Permission Sets
in the
Quick Find
box, then select Permission Sets and select the permission set you want to view.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Contact
Manager, Professional,
Group, Enterprise,
Performance, Unlimited,
Developer, and
Database.com Editions
USER PERMISSIONS
To delete permission sets and edit permission set properties:
•
Manage Profiles and
Permission Sets
App and System Settings in Permission Sets
In permission sets, permissions and settings are organized into app and system categories, which reflect the rights users need to administer and use system and app resources.
EDITIONS
App Settings
Apps are sets of tabs that users can change by selecting the drop-down menu in the header. All underlying objects, components, data, and configurations remain the same, regardless of the selected app. In selecting an app, users navigate in a set of tabs that allows them to efficiently use the underlying functionality for app-specific tasks. For example, let's say you do most of your work in the sales app, which includes tabs like Accounts and Opportunities. To track a new marketing campaign, rather than adding the Campaigns tab to the sales app, you select Marketing from the app drop-down to view your campaigns and campaign members.
Available in: Salesforce
Classic and Lightning
Experience
Available in: Contact
Manager, Professional,
Group, Enterprise,
Performance, Unlimited,
Developer, and
Database.com Editions
The Apps section of the permission sets overview page contains settings that are directly associated with the business processes the apps enable. For example, customer service agents might need to manage cases, so the “Manage Cases” permission is in the Call Center section of the App Permissions page. Some app settings aren't related to app permissions. For example,
Profiles
288
Set Up and Maintain Your Salesforce Organization to enable the Time-Off Manager app from the AppExchange, users need access to the appropriate Apex classes and Visualforce pages, as well as the object and field permissions that allow them to create new time-off requests.
System Settings
Some system functions apply to an organization and not to any single app. For example, “View Setup and Configuration” allows users to view setup and administrative settings pages. Other system functions apply to all apps. For example, the “Run Reports” and “Manage
Dashboards” permissions allow managers to create and manage reports in all apps. In some cases, such as with “Modify All Data,” a permission applies to all apps, but also includes non-app functions, like the ability to download the Data Loader.
SEE ALSO:
What Are Permission Set Licenses?
Search Permission Sets
To quickly navigate to other pages in a permission set, you can enter search terms in any permission set detail page.
On any of the permission sets detail pages, type at least three consecutive letters of an object, setting, or permission name in the Find Settings... box. The search terms aren't case-sensitive.
As you type, suggestions for results that match your search terms appear in a list. Click an item in the list to go to its settings page.
For some categories, you can search for the specific permission or setting name. For other categories, search for the category name.
Item
Assigned apps
Objects
•
Fields
•
Record types
Tabs
Search for
App name
Object name
Parent object name
Example
Type
sales
in the Find Settings box, then select
Sales
from the list.
Let’s say you have an Albums custom object.
Type
albu
, then select
Albums
.
Let’s say your Albums object contains a
Description field. To find the
Description field for albums, type
albu
, select
Albums
, and scroll down to
Description
under
Field Permissions.
Type
rep
, then select
Reports
.
Tab or parent object name
Permission name Type
api
, then select
API Enabled
.
App and system permissions
All other categories Category name To find Apex class access settings, type
apex
, then select
Apex Class Access
. To find custom permissions, type
cust
, then select
Custom Permissions
. And so on.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Contact
Manager, Professional,
Group, Enterprise,
Performance, Unlimited,
Developer, and
Database.com Editions
USER PERMISSIONS
To search permission sets:
•
View Setup and
Configuration
Profiles
289
Set Up and Maintain Your Salesforce Organization
If you don’t get any results, don’t worry. Here’s some tips that can help:
•
Check if the search term has at least three consecutive characters that match the object, setting, or permission name.
•
The permission, object, or setting you're searching for might not be available in the current Salesforce org.
•
The item you’re searching for might not be available for the user license that’s associated with the current permission set. For example, a permission set with the Standard Platform User license doesn’t include the “Modify All Data” permission.
•
The permission set license associated with the permission set doesn’t include the object, setting, or permission name you’re searching for.
SEE ALSO:
View and Edit Assigned Apps in Permission Sets
Assigned app settings specify the apps that users can select in the Force.com app menu.
Unlike profiles, you can’t assign a default app in permission sets. You can only specify whether apps are visible.
To assign apps:
1. From Setup, enter
Permission Sets
in the
Quick Find
box, then select Permission
Sets.
2. Select a permission set, or create one.
3. On the permission set overview page, click Assigned Apps.
4. Click Edit.
5. To assign apps, select them from the Available Apps list and click Add. To remove apps from the permission set, select them from the Enabled Apps list and click Remove.
6. Click Save.
SEE ALSO:
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Contact
Manager, Professional,
Group, Enterprise,
Performance, Unlimited,
Developer, and
Database.com Editions
USER PERMISSIONS
To edit assigned app settings:
•
Manage Profiles and
Permission Sets
Profiles
290
Set Up and Maintain Your Salesforce Organization
Assign Custom Record Types in Permission Sets
1. From Setup, enter
Permission Sets
in the
Quick Find
box, then select Permission
Sets.
2. Select a permission set, or create one.
3. On the permission set overview page, click Object Settings, then click the object you want.
4. Click Edit.
5. Select the record types you want to assign to this permission set.
6. Click Save.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Record types available in:
Professional, Enterprise,
Performance, Unlimited, and Developer Editions
IN THIS SECTION:
How is record type access specified?
You can assign record types to users in their profile or permission sets, or a combination of both. Record type assignment behaves differently in profiles and permission sets.
USER PERMISSIONS
To assign record types in permission sets:
•
Manage Profiles and
Permission Sets
SEE ALSO:
How is record type access specified?
How is record type access specified?
You can assign record types to users in their profile or permission sets, or a combination of both.
Record type assignment behaves differently in profiles and permission sets.
•
A user’s default record type is specified in the user’s personal settings. You can’t specify a default record type in permission sets.
•
You can assign the
--Master--
record type in profiles. In permission sets, you can assign only custom record types. The behavior for record creation depends on which record types are assigned in profiles and permission sets.
If users have this record type on their profile...
And this total number of custom record types in their permission sets...
When they create a record...
--Master--
None
--Master--
One
The new record is associated with the Master record type
The new record is associated with the custom record type.
Users can’t select the Master record type.
--Master--
Multiple
Custom One or more
Users are prompted to select a record type.
Users are prompted to select a record type. In their personal settings, users can set an option to use their default
EDITIONS
Available in: both Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, and Developer
Editions
Profiles
291
Set Up and Maintain Your Salesforce Organization
If users have this record type on their profile...
And this total number of custom record types in their permission sets...
When they create a record...
record type and not be prompted to choose a record type.
Profiles
•
Page layout assignments are specified in profiles only—they’re not available in permission sets. When a permission set specifies a custom record type, users with that permission set get the page layout assignment that’s specified for that record type in their profile.
(In profiles, page layout assignments are specified for every record type, even when record types aren’t assigned.)
•
For lead conversion, the default record type specified in a user’s profile is used for the converted records.
•
Users can view records assigned to any record type. As a result, a page layout is assigned to every record type on a user's profile. A record type assignment on a user’s profile or permission set doesn’t determine whether a user can view a record with that record type. The record type assignment simply specifies that the user can use that record type when creating or editing a record.
•
Record types in permission sets aren’t supported in packages and change sets. As a result, any record type assignments in permission sets in a sandbox organization must be manually reproduced in a production organization.
SEE ALSO:
Assign Record Types and Page Layouts in the Enhanced Profile User Interface
Assign Record Types to Profiles in the Original Profile User Interface
Assign Custom Record Types in Permission Sets
Assign Page Layouts in the Original Profile User Interface
292
Set Up and Maintain Your Salesforce Organization
Enable Custom Permissions in Permission Sets
Custom permissions give you a way to provide access to custom processes or apps. After you’ve created a custom permission and associated it with a process or app, you can enable the permission in permission sets.
1. From Setup, enter
Permission Sets
in the
Quick Find
box, then select Permission
Sets.
2. Select a permission set, or create one.
3. On the permission set overview page, click Custom Permissions.
4. Click Edit.
5. To enable custom permissions, select them from the Available Custom Permissions list and then click Add. To remove custom permissions from the permission set, select them from the
Enabled Custom Permissions list and then click Remove.
6. Click Save.
EDITIONS
Available in: both Salesforce
Classic and Lightning
Experience
Available in: Group,
Professional, Enterprise,
Performance, Unlimited, and Developer Editions
In Group and Professional
Edition organizations, you can’t create or edit custom permissions, but you can install them as part of a managed package.
USER PERMISSIONS
To enable custom permissions in permission sets:
•
Manage Profiles and
Permission Sets
Manage Permission Set Assignments
You can assign permission sets to a single user from the user detail page or assign multiple users to a permission set from any permission set page.
EDITIONS
•
Assign Permission Sets to a Single User
•
Assign a Permission Set to Multiple Users
•
Remove User Assignments from a Permission Set
Available in: Salesforce
Classic and Lightning
Experience
IN THIS SECTION:
Permission Set Assigned Users Page
From the Assigned Users page, you can view all users who are assigned to a permission set, assign more users, and remove user assignments.
Assign Permission Sets to a Single User
Assign permission sets or remove permission set assignments for a single user from the user detail page.
Assign a Permission Set to Multiple Users
Assign a permission set to one or more users from any permission set page.
Available in: Contact
Manager, Professional,
Group, Enterprise,
Performance, Unlimited,
Developer, and
Database.com Editions
Remove User Assignments from a Permission Set
From any permission set page, you can remove the permission set assignment from one or more users.
Profiles
293
Set Up and Maintain Your Salesforce Organization
Permission Set Assigned Users Page
From the Assigned Users page, you can view all users who are assigned to a permission set, assign more users, and remove user assignments.
To view all users who are assigned to a permission set, from any permission set page, click Manage
Assignments. From the Assigned Users page, you can:
•
Assign users to the permission set
•
Remove user assignments from the permission set
•
•
View a user's detail page by clicking the name, alias, or username
•
View a profile by clicking the profile name
SEE ALSO:
Assign Permission Sets to a Single User
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Contact
Manager, Professional,
Group, Enterprise,
Performance, Unlimited,
Developer, and
Database.com Editions
USER PERMISSIONS
To view users that are assigned to a permission set:
•
View Setup and
Configuration
Assign Permission Sets to a Single User
Assign permission sets or remove permission set assignments for a single user from the user detail page.
The Permission Set Assignments page shows:
•
Permission sets with no associated license. For example, you can assign a permission set if None was selected for the license type in the permission set. Make sure that the user’s license allows all the permission set’s enabled settings and permissions. If the user’s license doesn’t allow selected permissions, the assignment fails.
•
Permission sets that match the user’s license. For example, if a user’s license is Chatter Only, you can assign permission sets with the Chatter Only license.
•
Permission sets specific to permission set licenses. Let’s say you create a permission set named
Identity and associate that permission set to the “Identity Connect” permission set license. When you assign users to Identity, they receive all functionality available with the Identity Connect permission set license.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Contact
Manager, Professional,
Group, Enterprise,
Performance, Unlimited,
Developer, and
Database.com Editions
USER PERMISSIONS
Note: Some permissions require users to have a permission set license before you can grant the permissions. For example, if you add the “Use Identity Connect” user permission to the
Identity permission set, you can assign only users with the Identity Connect permission set license to the permission set.
1. From Setup, enter
Users
in the
Quick Find
box, then select Users.
2. Select a user.
To assign permission sets:
•
“Assign Permission Sets”
3. In the Permission Set Assignments related list, click Edit Assignments.
4. To assign a permission set, select it under Available Permission Sets and click Add. To remove a permission set assignment, select it under Enabled Permission Sets and click Remove.
Profiles
294
Set Up and Maintain Your Salesforce Organization
5. Click Save.
Tip: You can perform this and other administration tasks from the SalesforceA mobile app.
SEE ALSO:
Assign a Permission Set to Multiple Users
Help Users From Anywhere With SalesforceA
Assign a Permission Set to Multiple Users
Assign a Permission Set to Multiple Users
Assign a permission set to one or more users from any permission set page.
1. Select the permission set that you want to assign to users.
2. Click Manage Assignments and then Add Assignments.
3. Select the checkboxes next to the names of the users you want assigned to the permission set, and click Assign.
Messages confirm success or indicate if a user doesn’t have the appropriate licenses for assignment.
SEE ALSO:
Remove User Assignments from a Permission Set
Assign Permission Sets to a Single User
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Contact
Manager, Professional,
Group, Enterprise,
Performance, Unlimited,
Developer, and
Database.com Editions
USER PERMISSIONS
To assign a permission set to users:
•
Assign Permission Sets
Profiles
295
Set Up and Maintain Your Salesforce Organization Revoking Permissions and Access
Remove User Assignments from a Permission Set
From any permission set page, you can remove the permission set assignment from one or more users.
1. From Setup, enter
Permission Sets
in the
Quick Find
box, then select Permission
Sets.
2. Select a permission set.
3. In the permission set toolbar, click Manage Assignments.
4. Select the users to remove from this permission set.
You can remove up to 1000 users at a time.
5. Click Remove Assignments.
This button is only available when one or more users are selected.
6. To return to a list of all users assigned to the permission set, click Done.
SEE ALSO:
Assign a Permission Set to Multiple Users
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Contact
Manager, Professional,
Group, Enterprise,
Performance, Unlimited,
Developer, and
Database.com Editions
USER PERMISSIONS
To remove permission set assignments:
•
Assign Permission Sets
Revoking Permissions and Access
You can use profiles and permission sets to grant access, but not to deny access. Any permission granted from either a profile or permission set is honored. For example, if “Transfer Record” isn't enabled in Jane Smith's profile, but is enabled in two of her permission sets, she can transfer records regardless of whether she owns them. To revoke a permission, you must remove all instances of the permission from the user. You can do this with the following actions—each has possible consequences.
Action Consequence
Disable a permission or remove an access setting in the profile and any permission sets that are assigned to the user.
The permission or access setting is disabled for all other users assigned to the profile or permission sets.
If a permission or access setting is enabled in the user's profile, assign a different profile to the user.
The user may lose other permissions or access settings associated with the profile or permission sets.
AND
If the permission or access setting is enabled in any permission sets that are assigned to the user, remove the permission set assignments from the user.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Contact
Manager, Professional,
Group, Enterprise,
Performance, Unlimited,
Developer, and
Database.com Editions
To resolve the consequence in either case, consider all possible options. For example, you can clone the assigned profile or any assigned permission sets where the permission or access setting is enabled. Then, disable the permission or access setting, and assign the cloned
296
Set Up and Maintain Your Salesforce Organization What Determines Field Access?
profile or permission sets to the user. Another option is to create a base profile with the least number of permissions and settings that represents the largest number of users possible. Then create permission sets that layer more access.
SEE ALSO:
Assign Permission Sets to a Single User
What Determines Field Access?
Several factors control whether users can view and edit specific fields in Salesforce. You can control users’ access to fields at the record type, user, or field level.
•
Page layouts—Set whether fields are visible, required, editable, or read only for a particular record type.
•
Field-level security—Further restrict users’ access to fields by setting whether those fields are visible, editable, or read only. These settings override field properties set in the page layout if the field-level security setting is more restrictive.
•
Permissions—Some user permissions override both page layouts and field-level security settings. For example, users with the “Edit Read Only Fields” permission can always edit read-only fields regardless of any other settings.
•
Universally required fields—Override field-level security or any less-restrictive settings on page layouts by making a custom field universally required.
After setting these items, confirm users’ access to specific fields using the
.
EDITIONS
Available in: both Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
Page layouts are not available in Database.com
SEE ALSO:
Modifying Field Access Settings
Verify Access for a Particular Field
See whether access to a field is restricted and at what level—record type, user profile, or field.
1. Navigate to the fields area of the appropriate object:
•
For Knowledge validation status picklists, from Setup, enter
Validation Statuses
in the
Quick Find
box, then select Validation Statuses.
2. Select a field and click View Field Accessibility.
3. Confirm that the field access is correct for different profiles and record types.
4. Hover over any field access setting to see whether the field is required, editable, hidden, or read only based on the page layout or field-level security.
5. Click any field access setting to change it.
To verify field accessibility by a specific profile, record type, or field, from Setup, enter
Field
Accessibility
in the
Quick Find
box, then select Field Accessibility. From this page, choose a particular tab to view and then select whether you want to check access by profiles, record types, or fields.
EDITIONS
Available in: both Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
USER PERMISSIONS
To view field accessibility:
•
View Setup and
Configuration
297
Set Up and Maintain Your Salesforce Organization Field-Level Security
Note: In this user interface, you can’t check access for permission sets.
SEE ALSO:
Modifying Field Access Settings
From the field accessibility grid, you can click any field access setting to change the field’s accessibility in the page layout or in field-level security. The Access Settings page then lets you modify the field access settings.
•
In the Field-Level Security section of the page, specify the field's access level for the profile.
Access Level
Users can read and edit the field.
Users can read but not edit the field.
Users can’t read or edit the field.
Enabled Settings
Visible
Visible and Read-Only
None
EDITIONS
Available in: both Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
We recommend that you use field-level security to control users’ access to fields rather than creating multiple page layouts to control field access.
•
In the Page Layout section of the page, you can:
–
Select the
Remove or change editability
radio button and then change the field access properties for the page layout. These changes will affect all profile and record type combinations that currently use this page layout.
–
Alternatively, you can select the
Choose a different page layout
radio button to assign a different page layout to the profile and record type combination.
USER PERMISSIONS
To view field accessibility:
•
View Setup and
Configuration
To change field accessibility:
•
Customize Application
AND
Manage Profiles and
Permission Sets
SEE ALSO:
Field-Level Security
Field-level security settings let you restrict users’ access to view and edit specific fields.
Note: Who Sees What: Field-Level Security (Salesforce Classic)
Watch how you can restrict access to specific fields on a profile-by-profile basis.
Your Salesforce org contains a lot of data, but you probably don’t want every field accessible to everyone. For example, your payroll manager probably wants to keep salary fields accessible only to select employees. You can restrict user access in:
•
Detail and edit pages
•
Related lists
•
List views
EDITIONS
Available in: Salesforce
Classic
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
298
Set Up and Maintain Your Salesforce Organization Field-Level Security
•
Reports
•
Connect Offline
•
Email and mail merge templates
•
Custom links
•
The partner portal
•
The Salesforce Customer Portal
•
Synchronized data
•
Imported data
The fields that users see on detail and edit pages are a combination of page layouts and field-level security settings. The most restrictive field access settings of the two always applies. For example, you can have a field that’s required in a page layout but is read-only in the field-level security settings. The field-level security overrides the page layout, so the field remains read-only.
Important: Field-level security doesn’t prevent searching on the values in a field. When search terms match on field values protected by field-level security, the associated records are returned in the search results without the protected fields and their values.
You can define field-level security in either of these ways.
•
For multiple fields on a single permission set or profile
•
For a single field on all profiles
After setting field-level security, you can:
•
Create page layouts to organize the fields on detail and edit pages.
Tip: Use field-level security to restrict users’ access to fields, and then use page layouts to organize detail and edit pages within tabs. This approach reduces the number of page layouts for you to maintain.
•
Verify users’ access to fields by checking field accessibility.
•
Customize search layouts to set the fields that appear in search results, in lookup dialog search results, and in the key lists on tab home pages.
Note: Roll-up summary and formula fields are read-only on detail pages and not available on edit pages. They can also be visible to users even though they reference fields that your users can’t see. Universally required fields appear on edit pages regardless of field-level security.
The relationship group wizard allows you to create and edit relationship groups regardless of field-level security.
299
Set Up and Maintain Your Salesforce Organization Field-Level Security
Set Field Permissions in Permission Sets and Profiles
Field permissions specify the access level for each field in an object.
1. From Setup, either:
•
Enter
Permission Sets
in the
Quick Find
box, then select Permission Sets, or
•
Enter
Profiles
in the
Quick Find
box, then select Profiles
2. Select a permission set or profile.
3. Depending on which interface you're using, do one of the following:
•
Permission sets or enhanced profile user interface—In the Find Settings... box, enter the name of the object you want and select it from the list. Click Edit, then scroll to the Field
Permissions section.
•
Original profile user interface—In the Field-Level Security section, click View next to the object you want to modify, and then click Edit.
4. Specify the field's access level.
5. Click Save.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
USER PERMISSIONS
To set field-level security:
•
Manage Profiles and
Permission Sets
AND
Customize Application
Set Field-Level Security for a Single Field on All Profiles
1. From the management settings for the field’s object, go to the fields area.
2. Select the field you want to modify.
3. Click View Field Accessibility.
4. Specify the field's access level.
EDITIONS
Available in: Salesforce
Classic
Available in: Professional,
Enterprise, Performance,
Unlimited, and Developer
Editions
USER PERMISSIONS
To set field-level security:
•
Manage Profiles and
Permission Sets
AND
Customize Application
300
Set Up and Maintain Your Salesforce Organization User Permissions
User Permissions
User permissions specify what tasks users can perform and what features users can access. For example, users with the “View Setup and Configuration” permission can view Setup pages, and users with the “API Enabled” permission can access any Salesforce API.
You can enable user permissions in permission sets and custom profiles. In permission sets and the enhanced profile user interface, these permissions—as well as their descriptions—are listed in the
App Permissions or System Permissions pages. In the original profile user interface, user permissions are listed under Administrative Permissions and General User Permissions.
To view permissions and their descriptions, from Setup, enter
Permission Sets
in the
Quick
Find
box, then select Permission Sets, then select or create a permission set. Then from the
Permission Set Overview page, click App Permissions or System Permissions.
SEE ALSO:
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
The user permissions available vary according to which edition you have.
Object Permissions
Object permissions specify the base-level access users have to create, read, edit, and delete records for each object. You can manage object permissions in permission sets and profiles.
Object permissions either respect or override sharing rules and settings. The following permissions specify the access that users have to objects.
Permission
Read
Create
Edit
Delete
View All
Description
Users can only view records of this type.
Users can read and create records.
Users can read and update records.
Respects or
Overrides Sharing?
Respects sharing
Respects sharing
Respects sharing
Users can read, edit, and delete records.
Users can view all records associated with this object, regardless of sharing settings.
Respects sharing
Overrides sharing
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
301
Set Up and Maintain Your Salesforce Organization
Permission
Modify All
Object Permissions
Description
Users can read, edit, delete, transfer, and approve all records associated with this object, regardless of sharing settings.
Note: “Modify All” on documents allows access to all shared and public folders, but not the ability to edit folder properties or create new folders. To edit folder properties and create new folders, users must have the “Manage Public
Documents” permission.
Respects or Overrides
Sharing?
Overrides sharing
SEE ALSO:
“View All” and “Modify All” Permissions Overview
“View All” and “Modify All” Permissions Overview
The “View All” and “Modify All” permissions ignore sharing rules and settings, allowing administrators to grant access to records associated with a given object across the organization. “View All” and
“Modify All” can be better alternatives to the “View All Data” and “Modify All Data” permissions.
Be aware of the following distinctions between the permission types.
Permissions
View All
Modify All
View All Data
Modify All Data
View All Users
Used for
Delegation of object permissions.
Managing all data in an organization; for example, data cleansing, deduplication, mass deletion, mass transferring, and managing record approvals.
Users with View All Data (or Modify
All Data) permission can view (or modify) all apps and data, even if the apps and data are not shared with them.
Users who need them
Delegated administrators who manage records for specific objects
Administrators of an entire organization
Viewing all users in the organization.
Grants Read access to all users, so that you can see their user record details, see them in searches, list views, and so on.
Users who need to see all users in the organization. Useful if the organization-wide default for the user object is Private. Administrators with the “Manage Users” permission are automatically granted the “View All
Users” permission.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in all editions
302
Set Up and Maintain Your Salesforce Organization Object Permissions
“View All” and “Modify All” are not available for ideas, price books, article types, and products.
“View All” and “Modify All” allow for delegation of object permissions only. To delegate user administration and custom object administration duties,
define delegated administrators .
“View All Users” is available if your organization has User Sharing, which controls user visibility in the organization. To learn about User
Sharing, see
SEE ALSO:
Comparing Security Models
Salesforce user security is an intersection of
and
object permissions. In some cases,
such as in end-user record level access, it is advantageous to use sharing to provide access to records.
In other cases, such as when delegating record administration tasks like transferring records, cleansing data, deduplicating records, mass deleting records, and delegating workflow approval processes, it is advantageous to override sharing and use permissions to provide access to records.
The “Read,” “Create,” “Edit,” and “Delete” permissions respect sharing settings, which control access to data at the record level. The “View All” and “Modify All” permissions override sharing settings for specific objects. Additionally, the “View All Data” and “Modify All Data” permissions override sharing settings for all objects.
The following table describes the differences between the security models.
EDITIONS
Available in: Salesforce
Classic
Available in: Enterprise,
Performance, Unlimited,
Developer, and
Database.com Editions
Target audience
Where managed
Permissions that Respect Sharing
End-users
Permissions that Override Sharing
Delegated data administrators
“Read,” “Create,” “Edit,” and “Delete” object permissions;
Sharing settings
“View All” and “Modify All”
Record access levels
Ability to transfer
Private, Read-Only, Read/Write,
Read/Write/Transfer/Full Access
Respects sharing settings, which vary by object
“View All” and “Modify All”
Available on all objects with “Modify All”
Ability to approve records, or edit and unlock records in an approval process
None
Ability to report on all records
Object support
Available on all objects with “Modify All”
Available with a sharing rule that states: the records owned by the public group “Entire
Organization” are shared with a specified group, with Read-Only access
Available on all objects with “View All”
Available on all objects except products, documents, solutions, ideas, notes, and attachments
Available on most objects via object permissions
Note: “View All” and “Modify All” are not available for ideas, price books, article types, and products.
303
Set Up and Maintain Your Salesforce Organization Field Permissions
Group access levels determined by
Private record access
Ability to manually share records
Ability to manage all case comments
Permissions that Respect Sharing
Roles, Roles and Subordinates, Roles and
Internal Subordinates, Roles, Internal and
Portal Subordinates, Queues, Teams, and
Public Groups
Permissions that Override Sharing
Profile or permission sets
Not available Available on private contacts, opportunities, and notes and attachments with “View All” and “Modify All”
Available to the record owner and any user above the record owner in the role hierarchy
Available on all objects with “Modify All”
Not available Available with “Modify All” on cases
Field Permissions
Field permissions specify the access level for each field in an object. In permission sets and the enhanced profile user interface, the setting labels differ from those in the original profile user interface and in field-level security pages for customizing fields.
Access Level Enabled Settings in
Permission Sets and
Enhanced Profile User
Interface
Read
and
Edit
Users can read and edit the field.
Users can read but not edit the field.
Read
Users can't read or edit the field.
None
Enabled Settings in
Original Profile and
Field-Level Security
Interfaces
Visible
Visible
and
Read-Only
None
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
SEE ALSO:
304
Set Up and Maintain Your Salesforce Organization Sharing Settings
Sharing Settings
In Salesforce, you can control access to data at many different levels. For example, you can control the access your users have to objects with object permissions. Within objects, you can control the access users have to fields using field-level security. To control access to data at the record level, use sharing settings.
Note: Who Sees What: Overview (Salesforce Classic)
Watch how you can control who sees what data in your organization.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
Teams are not available in
Database.com
Organization-Wide Defaults
Your organization-wide default sharing settings give you a baseline level of access for each object and enable you to extend that level of access using hierarchies or sharing rules. For example, you can set the organization-wide default for leads to Private if you only want users to view and edit the leads they own. Then, you can create lead sharing rules to extend access of leads to particular users or groups.
Sharing Rules
Sharing rules represent the exceptions to your organization-wide default settings. If you have organization-wide sharing defaults of
Public Read Only or Private, you can define rules that give additional users access to records they do not own. You can create sharing rules based on record owner or field values in the record.
Tip:
Sometimes it’s impossible to define a consistent group of users who need access to a particular set of records. In those situations, record owners can use manual sharing to give read and edit permissions to users who would not have access to the record any other way. Although manual sharing isn’t automated like organization-wide sharing settings, role hierarchies, or sharing rules, it gives record owners the flexibility to share particular records with users that need to see them.
Apex Managed Sharing
Apex managed sharing allows developers to programmatically share custom objects. When you use Apex managed sharing to share a custom object, only users with the “Modify All Data” permission can add or change the sharing on the custom object's record, and the sharing access is maintained across record owner changes.
Other Methods for Allowing Access to Records
In addition to sharing settings, there are a few other ways to allow multiple users access to given records:
Map category groups to roles
Control access to data categories by mapping them to user roles.
Queues
Queues help you prioritize, distribute, and assign records to teams who share workloads. Queue members and users higher in a role hierarchy can access queues from list views and take ownership of records in a queue.
Use queues to route lead, order, case, and custom object records to a group.
Teams
For accounts, opportunities, and cases, record owners can use teams to allow other users access to their records. A team is a group of users that work together on an account, sales opportunity, or case. Record owners can build a team for each record that they own.
305
Set Up and Maintain Your Salesforce Organization Sharing Settings
The record owner adds team members and specifies the level of access each team member has to the record, so that some team members can have read-only access and others can have read/write access. The record owner can also specify a role for each team member, such as “Executive Sponsor.” In account teams, team members also have access to any contacts, opportunities, and cases associated with an account.
Note: A team member may have a higher level of access to a record for other reasons, such as a role or sharing rule. In this case, the team member has the highest access level granted, regardless of the access level specified in the team.
SEE ALSO:
Organization-Wide Sharing Defaults
Organization-Wide Sharing Defaults
Administrators can use organization-wide sharing settings to define the default sharing settings for an organization.
Organization-wide sharing settings specify the default level of access to records and can be set separately for accounts (including contracts), activities, assets, contacts, campaigns, cases, leads, opportunities, calendars, price books, orders, and custom objects.
For most objects, organization-wide sharing settings can be set to Private, Public Read Only, or
Public Read/Write. In environments where the organization-wide sharing setting for an object is
Private or Public Read Only, an administrator can grant users additional access to records by setting up a role hierarchy or defining sharing rules. However, sharing rules can only be used to grant additional access—they cannot be used to restrict access to records beyond what was originally specified with the organization-wide sharing defaults.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions.
Customer Portal is not available in Database.com
Important: If your organization uses a Customer Portal, before you enable contacts to access the portal, set the organization-wide sharing defaults on accounts, contacts, contracts, assets, and cases to Private. This ensures that by default your customers can view only their own data. You can still grant your Salesforce users Public Read/Write access by creating sharing rules in which all internal users share with all internal users.
By default, Salesforce uses hierarchies, like the role or territory hierarchy, to automatically grant access of records to users above the record owner in the hierarchy.
Setting an object to Private makes those records visible only to record owners and those above them in the role hierarchy. Use the Grant
Access Using Hierarchies checkbox to disable access to records to users above the record owner in the hierarchy for custom objects in Professional, Enterprise, Unlimited, Performance, and Developer Edition. If you deselect this checkbox for a custom object, only the record owner and users granted access by the organization-wide defaults receive access to the records.
SEE ALSO:
Set Your Organization-Wide Sharing Defaults
Sharing Default Access Settings
Default Organization-Wide Sharing Settings
306
Set Up and Maintain Your Salesforce Organization Sharing Settings
Set Your Organization-Wide Sharing Defaults
Organization-wide sharing defaults set the baseline access for your records. You can set the defaults separately for different objects.
Note:
Who Sees What: Organization-Wide Defaults (Salesforce Classic)
Watch how you can restrict access to records owned by other users.
1. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing
Settings.
2. Click Edit in the Organization-Wide Defaults area.
3. For each object, select the default access you want to use. If you have external organization-wide
defaults, see External Organization-Wide Defaults Overview
.
4. To disable automatic access using your hierarchies, deselect Grant Access Using Hierarchies for any custom object that does not have a default access of Controlled by Parent.
Note: If Grant Access Using Hierarchies is deselected, users that are higher in the role or territory hierarchy don’t receive automatic access. However, some users—such as those with the “View All” and “Modify All” object permissions and the “View All Data” and
“Modify All Data” system permissions—can still access records they don’t own.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, and Developer
Editions
USER PERMISSIONS
To set default sharing access:
•
Manage Sharing
When you update organization-wide defaults, sharing recalculation applies the access changes to your records. If you have a lot of data, the update can take longer.
•
If you are increasing the default access, such as from Public Read Only to Public Read/Write, your changes take effect immediately.
All users get access based on the updated default access. Sharing recalculation is then run asynchronously to ensure that all redundant access from manual or sharing rules are removed.
Note:
When the default access for contacts is Controlled by Parent and you increase the default access for accounts, opportunities, or cases, the changes take effect after recalculation is run.
•
If you are decreasing the default access, such as from Public Read/Write to Public Read Only, your changes take effect after recalculation is run.
You’ll receive a notification email when the recalculation completes. Refresh the Sharing Settings page to see your changes. To view the update status, from Setup, enter
View Setup Audit Trail
in the
Quick Find
box, then select View Setup Audit Trail.
Limitations
The organization-wide sharing default setting can’t be changed for some objects:
•
Service contracts are always Private.
•
User provisioning requests are always Private.
•
The ability to view or edit a document, report, or dashboard is based on a user’s access to the folder in which it’s stored.
•
Users can only view the forecasts of other users who are placed below them in the role hierarchy, unless forecast sharing is enabled.
•
When a custom object is on the detail side of a master-detail relationship with a standard object, its organization-wide default is set to Controlled by Parent and it is not editable.
•
The organization-wide default settings can’t be changed from private to public for a custom object if Apex code uses the sharing entries associated with that object. For example, if Apex code retrieves the users and groups who have sharing access on a custom
307
Set Up and Maintain Your Salesforce Organization Sharing Settings object Invoice__c (represented as
Invoice__share
in the code), you can’t change the object’s organization-wide sharing setting from private to public.
SEE ALSO:
Sharing Default Access Settings
Organization-Wide Sharing Defaults
Sharing Default Access Settings
You can use organization-wide defaults to set the default level of record access for the following objects.
•
Accounts and their associated contracts
•
Activities
•
Calendars
•
Campaigns
•
Cases
•
Contacts
•
Custom objects
•
Leads
•
Opportunities
•
Orders
•
Price books
•
Service contracts
•
Users
You can assign the following access levels to accounts, campaigns, cases, contacts, contracts, leads, opportunities, orders, users, and custom objects.
Field
Controlled by Parent
Private
EDITIONS
Available in: Salesforce
Classic
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
Only Custom Objects are available in Database.com
USER PERMISSIONS
To set default sharing access:
•
Manage Sharing
Description
A user can perform an action (such as view, edit, or delete) on a contact or order based on whether he or she can perform that same action on the record associated with it.
For example, if a contact is associated with the Acme account, then a user can only edit that contact if he or she can also edit the Acme account.
Only the record owner, and users above that role in the hierarchy, can view, edit, and report on those records.
For example, if Tom is the owner of an account, and he is assigned to the role of Western Sales, reporting to Carol (who is in the role of VP of Western Region Sales), then Carol can also view, edit, and report on Tom’s accounts.
308
Set Up and Maintain Your Salesforce Organization
Field
Public Read Only
Public Read/Write
Public Read/Write/Transfer
Public Full Access
Sharing Settings
Description
All users can view and report on records but not edit them. Only the owner, and users above that role in the hierarchy, can edit those records.
For example, Sara is the owner of ABC Corp. Sara is also in the role
Western Sales, reporting to Carol, who is in the role of VP of Western
Region Sales. Sara and Carol have full read/write access to ABC
Corp. Tom (another Western Sales Rep) can also view and report on ABC Corp, but cannot edit it.
All users can view, edit, and report on all records.
For example, if Tom is the owner of Trident Inc., all other users can view, edit, and report on the Trident account. However, only Tom can alter the sharing settings or delete the Trident account.
All users can view, edit, transfer, and report on all records. Only available for cases or leads.
For example, if Alice is the owner of ACME case number 100, all other users can view, edit, transfer ownership, and report on that case. But only Alice can delete or change the sharing on case 100.
All users can view, edit, transfer, delete, and report on all records.
Only available for campaigns.
For example, if Ben is the owner of a campaign, all other users can view, edit, transfer, or delete that campaign.
Note:
To use cases effectively, set the organization-wide default for Account, Contact, Contract, and Asset to Public Read/Write.
You can assign the following access levels to personal calendars.
Field
Hide Details
Hide Details and Add Events
Show Details
Show Details and Add Events
Full Access
Description
Others can see whether the user is available at given times, but can not see any other information about the nature of events in the user’s calendar.
In addition to the sharing levels set by Hide Details, users can insert events in other users’ calendars.
Users can see detailed information about events in other users’ calendars.
In addition to the sharing levels set by Show Details, users can insert events in other users’ calendars.
Users can see detailed information about events in other users’ calendars, insert events in other users’ calendars, and edit existing events in other users’ calendars.
309
Set Up and Maintain Your Salesforce Organization Sharing Settings
Note: Regardless of the organization-wide defaults that have been set for calendars, all users can invite all other users to events.
You can assign the following access levels to price books.
Field
Use
View Only
No Access
Description
All users can view price books and add them to opportunities.
Users can add any product within that price book to an opportunity.
All users can view and report on price books but only users with the “Edit” permission on opportunities or users that have been manually granted use access to the price book can add them to opportunities.
Users cannot see price books or add them to opportunities. Use this access level in your organization-wide default if you want only selected users to access selected price books. Then, manually share the appropriate price books with the appropriate users.
You can assign the following access levels to activities.
Field
Private
Controlled by Parent
Description
Only the activity owner, and users above the activity owner in the role hierarchy, can edit and delete the activity; users with read access to the record to which the activity is associated can view and report on the activity.
A user can perform an action (such as view, edit, transfer, and delete) on an activity based on whether he or she can perform that same action on the records associated with the activity.
For example, if a task is associated with the Acme account and the
John Smith contact, then a user can only edit that task if he or she can also edit the Acme account and the John Smith record.
You can assign the following access levels to users.
Field
Private
Public Read Only
Description
All users have read access to their own user record and those below them in the role hierarchy.
All users have read access on one another. You can see all users’ detail pages. You can also see all users in lookups, list views, ownership changes, user operations, and search.
SEE ALSO:
Set Your Organization-Wide Sharing Defaults
310
Set Up and Maintain Your Salesforce Organization
Default Organization-Wide Sharing Settings
The default organization-wide sharing settings are:
Object
Account
Activity
Asset
Calendar
Campaign
Case
Contact
Contract
Custom Object
Lead
Opportunity
Price Book
Service Contract
Users
Default Access
Public Read/Write
Private
Controlled by Parent
Hide Details and Add Events
Public Full Access
Public Read/Write/Transfer
Controlled by Parent
Public Read/Write
Public Read/Write
Public Read/Write/Transfer
Public Read Only
Use
Private
Public Read Only
Private for external users
Sharing Settings
EDITIONS
Accounts, cases, contacts, leads, opportunities, and custom objects available in:
Salesforce Classic and
Lightning Experience
Available in: Professional,
Enterprise, Performance,
Unlimited,Developer, and
Database.com Editions.
Except for Custom Objects, all object types are not available in Database.com
SEE ALSO:
Organization-Wide Sharing Defaults
Set Your Organization-Wide Sharing Defaults
External Organization-Wide Defaults Overview
External organization-wide defaults provide separate organization-wide defaults for internal and external users. They simplify your sharing rules configuration and improve recalculation performance.
Additionally, administrators can easily see which information is being shared to portals and other external users.
The following objects support external organization-wide defaults.
•
Accounts and their associated contracts and assets
•
Cases
•
Contacts
•
Opportunities
•
Custom Objects
•
Users
EDITIONS
Available in: Salesforce
Classic
Available in: Professional,
Enterprise, Performance,
Unlimited, and Developer
Editions
311
Set Up and Maintain Your Salesforce Organization Sharing Settings
External users include:
•
Authenticated website users
•
Chatter external users
•
Community users
•
Customer Portal users
•
Guest users
•
High-volume portal users
•
Partner Portal users
•
Service Cloud Portal users
Note: Chatter external users have access to the User object only.
Previously, if your organization wanted Public Read Only or Public Read/Write access for internal users but Private for external users, you would have to set the default access to Private and create a sharing rule to share records with all internal users.
With separate organization-wide defaults, you can achieve similar behavior by setting the default internal access to Public Read Only or
Public Read/Write and the default external access to Private. These settings also speed up performance for reports, list views, searches, and API queries.
SEE ALSO:
Organization-Wide Sharing Defaults
Setting the External Organization-Wide Defaults
Sharing Default Access Settings
Setting the External Organization-Wide Defaults
External Organization-Wide Defaults enable you to set a different default access level for external users.
Before you set the external organization-wide defaults, make sure that it is enabled. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing Settings, and click the Enable External Sharing Model button.
When you first enable external organization-wide defaults, the default internal access and default external access are set to the original default access level. For example, if your organization-wide default for contacts is Private, the default internal access and default external access will be Private as well.
To set the external organization-wide default for an object:
1. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing
Settings
2. Click Edit in the Organization-Wide Defaults area.
3. For each object, select the default access you want to use.
You can assign the following access levels.
EDITIONS
Available in: Salesforce
Classic
Available in: Professional,
Enterprise, Performance,
Unlimited, and Developer
Editions
USER PERMISSIONS
To set default sharing access:
•
Manage Sharing
312
Set Up and Maintain Your Salesforce Organization
Access Level
Controlled by Parent
Private
Public Read Only
Public Read/Write
Sharing Settings
Description
Users can perform actions (such as view, edit, delete) on a record on the detail side of a master-detail relationship if they can perform the same action on all associated master records.
Note:
For contacts,
Controlled by Parent
must be set for both the default internal and external access.
Only users who are granted access by ownership, permissions, role hierarchy, manual sharing, or sharing rules can access the records.
All users can view all records for the object.
All users can view and edit all records for the object.
Note: The default external access level must be more restrictive or equal to the default internal access level. For example, you can have a custom object with default external access set to Private and default internal access set to Public Read Only.
4. Click Save.
SEE ALSO:
External Organization-Wide Defaults Overview
Disabling External Organization-Wide Defaults
Disabling External Organization-Wide Defaults results in one organization-wide default for each object.
Before disabling this feature, set Default External Access and Default Internal Access to the same access level for each object.
To disable the external organization-wide defaults:
1. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing
Settings
2. Click Disable External Sharing Model in the Organization-Wide Defaults area.
After disabling the external organization-wide defaults, you’ll see the Default Access setting instead of the Default External Access and Default Internal Access settings in the organization-wide defaults area. If you have User Sharing, the Default External Access settings for the account, contact, case, and opportunity objects remain visible but they are disabled.
SEE ALSO:
External Organization-Wide Defaults Overview
EDITIONS
Available in: Salesforce
Classic
Available in: Professional,
Enterprise, Performance,
Unlimited, and Developer
Editions
USER PERMISSIONS
To disable external organization-wide defaults:
•
Manage Sharing
313
Set Up and Maintain Your Salesforce Organization Controlling Access Using Hierarchies
Controlling Access Using Hierarchies
Determine whether users have access to records they don’t own, including records to which they don’t have sharing access, but someone below them in the hierarchy does.
Beyond setting the organization-wide sharing defaults for each object, you can specify whether users have access to the data owned by or shared with their subordinates in the hierarchy. For example, the role hierarchy automatically grants record access to users above the record owner in the hierarchy. By default, the
Grant Access Using Hierarchies
option is enabled for all objects, and it can only be changed for custom objects.
To control sharing access using hierarchies for any custom object, from Setup, enter
Sharing
Settings
in the
Quick Find
box, then select Sharing Settings. Next, click Edit in the
Organization Wide Defaults section. Deselect
Grant Access Using Hierarchies
if you want to prevent users from gaining automatic access to data owned by or shared with their subordinates in the hierarchies.
EDITIONS
Available in: Salesforce
Classic
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
Territories are not available in Database.com
USER PERMISSIONS
Implementation Notes
•
Regardless of your organization's sharing settings, users can gain access to records they do not own through other means such as user permissions like “View All Data,” sharing rules, or manual sharing of individual records.
•
The
Grant Access Using Hierarchies
option is always selected on standard objects and is not editable.
To set default sharing access and change the
Grant Access Using
Hierarchies
option:
•
Manage Sharing
•
If you disable the
Grant Access Using Hierarchies
option, sharing with a role or territory and subordinates only shares with the users directly associated with the role or territory selected. Users in roles or territories above them in the hierarchies will not gain access.
•
If your organization disables the
Grant Access Using Hierarchies
option, activities associated with a custom object are still visible to users above the activity’s assignee in the role hierarchy.
•
If a master-detail relationship is broken by deleting the relationship, the former detail custom object's default setting is automatically reverted to Public Read/Write and
Grant Access Using Hierarchies
is selected by default.
•
The
Grant Access Using Hierarchies
option affects which users gain access to data when something is shared with public groups, personal groups, queues, roles, or territories. For example, the View All Users option displays group members and people above them in the hierarchies when a record is shared with them using a sharing rule or manual sharing and the
Grant
Access Using Hierarchies
option is selected. When the
Grant Access Using Hierarchies
option is not selected, some users in these groups no longer have access. The following list covers the access reasons that depend on the
Grant
Access Using Hierarchies
option.
These reasons always gain access:
Group Member
Queue Member
Role Member
Member of Subordinate Role
Territory Member
Member of Subordinate Territory
These reasons only gain access when using hierarchies:
Manager of Group Member
314
Set Up and Maintain Your Salesforce Organization User Role Hierarchy
Manager of Queue Member
Manager of Role
Manager of Territory
User Role Manager of Territory
Best Practices
•
When you deselect
Grant Access Using Hierarchies
, notify users of the changes in report results that they can expect due to losing visibility of their subordinates' data. For example, selecting My team's... in the View drop-down list returns records owned by the user; it will not include records owned by their subordinates. To be included in this type of report view, records from subordinates must be explicitly shared with that user by some other means such as a sharing rule or a manual share. So, if no records are shared with you manually, the My... and My team's... options in the View drop-down list return the same results. However, choosing the Activities with... any custom object report type when creating a custom report returns activities assigned to you as well as your subordinates in the role hierarchy.
SEE ALSO:
User Role Hierarchy
Salesforce offers a user role hierarchy that you can use with sharing settings to determine the levels of access that users have to your Salesforce org’s data. Roles within the hierarchy affect access on key components such as records and reports.
If your organization-wide defaults are more restrictive than Public Read/Write, use role hierarchy to make records more accessible to users.
Watch a Demo: Who Sees What: Record Access via the Role Hierarchy (Salesforce
Classic)
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, and Developer
Editions
Users at any role level can view, edit, and report on all data that’s owned by or shared with users below them in the role hierarchy, unless your Salesforce org’s sharing model for an object specifies otherwise. Specifically, in the Organization-Wide Defaults related list, you can disable the Grant
Access Using Hierarchies option for a custom object. When disabled, only the record owner and users who are granted access by the organization-wide defaults receive access to the object’s records.
USER PERMISSIONS
To create, edit, and delete roles:
•
Manage Roles
To assign users to roles:
•
Manage Internal Users
Roles determine user access to cases, contacts, and opportunities, regardless of who owns those records. The access level is specified on the Role Edit page. For example, you can set the contact access so that users in a role can edit all contacts associated with accounts that they own, regardless of who owns the contacts. And you can set the opportunity access so that users in a role can edit all opportunities associated with accounts that they own, regardless of who owns the opportunities.
After you share a folder with a role, it’s visible only to users in that role, not to superior roles in the hierarchy.
315
Set Up and Maintain Your Salesforce Organization User Role Hierarchy
Guidelines for Success with Roles
Understand key rule behaviors and apply best practices for success with roles.
EDITIONS
For best practices on designing record access in a large organization, see
Access for Enterprise Scale
.
Designing Record
Available in: Salesforce
Classic and Lightning
Experience
•
To simplify user management in organizations with large numbers of users, enable delegated administrators to manage users in specified roles and all subordinate roles.
Available in: Professional,
Enterprise, Performance,
Unlimited, and Developer
Editions
•
You can create up to 500 roles for your organization.
•
Every user must be assigned to a role, or their data will not display in opportunity reports, forecast roll-ups, and other displays based on roles.
•
All users that require visibility to the entire organization should belong to the highest level in the hierarchy.
•
It is not necessary to create individual roles for each title at your company. Instead, define a hierarchy of roles to control access of information entered by users in lower level roles.
•
When you change a user’s role, the sharing rules for the new role are applied.
•
If you are a Salesforce Knowledge user, you can modify category visibility settings on the role detail page.
•
To avoid performance issues, no single user should own more than 10,000 records of an object. Users who need to own more than that number of objects should either not be assigned a role or placed in a separate role at the top of the hierarchy. It’s also important to keep that user out of public groups that might be used as the source for sharing rules.
•
When an account owner is not assigned a role, the sharing access for related contacts is Read/Write, provided the organization-wide default for contacts is not Controlled by Parent. Sharing access on related opportunities and cases is No Access.
•
If your organization uses Territory Management, forecasts are based on the territory hierarchy rather than the role hierarchy.
Assign Users to Roles
Quickly assign users to a particular role.
1. From Setup, enter
Roles
in the
Quick Find
box, then select Roles.
2. Click Assign next to the name of the desired role.
Note: You can also access this page by clicking Assign Users to Role from the Users in
Role related list. Large organizations should consider assigning roles via the SOAP API for efficiency.
3. Make a selection from the drop-down list to show the available users.
4. Select a user on the left, and click Add to assign the user to this role.
Note: Removing a user from the Selected Users list deletes the role assignment for that user.
SEE ALSO:
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, and Developer
Editions
USER PERMISSIONS
To assign users to roles:
•
Manage Internal Users
316
Set Up and Maintain Your Salesforce Organization User Role Hierarchy
Role Fields
The fields that comprise a role entry have specific purposes. Refer to this table for descriptions of each field and how it functions in a role.
The visibility of fields depends on your organization’s permissions and sharing settings.
Field
Case Access
Contact Access
Label
Modified By
Opportunity Access
Partner Role
Role Name
Role Name as displayed on reports
Sharing Groups
Description
Specifies whether users can access other users’ cases that are associated with accounts the users own. This field is not visible if your organization’s sharing model for cases is Public Read/Write.
Specifies whether users can access other users’ contacts that are associated with accounts the users own. This field is not visible if your organization’s sharing model for contacts is
Public Read/Write or Controlled by Parent.
The name used to refer to the role or title of position in any user interface pages, for example,
Western Sales VP.
The name of the user who last modified this role's details, and the date and time that the role was modified.
Specifies whether users can access other users’ opportunities that are associated with accounts the users own. This field is not visible if your organization’s sharing model for opportunities is Public Read/Write.
Indicates whether this role is associated with a partner account. This field is available only when a Customer Portal or partner portal is enabled for the organization.
If this checkbox is selected, you cannot edit the role. The default number of roles in portal accounts is three. You can reduce the number of roles or add roles to a maximum of three.
The unique name used by the API and managed packages.
A role name that appears in reports. When editing a role, if the
Role Name
is long, you can enter an abbreviated name in this field.
These groups are automatically created and maintained. The Role group contains all users in this role plus all users in roles above this role.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
USER PERMISSIONS
To create or edit roles:
•
Manage Roles
317
Set Up and Maintain Your Salesforce Organization What Is a Group?
Field
This role reports to
Description
The Role and Subordinates group contains all users in this role plus all users in roles above and below this role in the hierarchy. The
Role and Internal Subordinates group (available if Customer Portals or partner portals are enabled for your organization) contains all users in this role. It also contains all users in roles above and below this role, excluding Customer Portal and partner portal users.
The role above this role in the hierarchy.
SEE ALSO:
What Is a Group?
A group consists of a set of users. A group can contain individual users, other groups, or the users in a particular role or territory. It can also contain the users in a particular role or territory plus all the users below that role or territory in the hierarchy.
There are two types of groups.
Public groups
Administrators and delegated administrators can create public groups. Everyone in the organization can use public groups. For example, an administrator can create a group for an employee carpool program. All employees can then use this group to share records about the program.
Personal groups
Each user can create groups for their personal use. For example, users might need to ensure that certain records are always shared within a specified workgroup.
You can use groups in the following ways.
•
To set up default sharing access via a sharing rule
•
To share your records with other users
•
To specify that you want to synchronize contacts owned by other users
•
To add multiple users to a Salesforce CRM Content library
•
To assign users to specific actions in Salesforce Knowledge
SEE ALSO:
Sharing Records with Manager Groups
EDITIONS
Available in: both Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
318
Set Up and Maintain Your Salesforce Organization What Is a Group?
Public Group Considerations
For organizations with a large number of users, consider these tips when creating public groups to optimize performance.
•
Create a group when at least a few users need the same access.
•
Create a group for members who don’t need to frequently move in or out of the groups.
•
Avoid creating groups within groups that result in more than five levels of nesting.
•
Enable automatic access to records using role hierarchies for public groups by selecting Grant
Access Using Hierarchies when creating the group. However, don’t use this option if you’re creating a public group with All Internal Users as members.
SEE ALSO:
Group Member Types
Many types of groups are available for various internal and external users.
When you create or edit a group, you can select the following types of members from the
Search drop-down list. Depending on your organization settings, some types may not be available.
Member Type
Customer Portal Users
Partner Users
Personal Groups
Portal Roles
Portal Roles and Subordinates
Description
All of your Customer Portal users. This is only available when a Customer Portal is enabled for your organization.
All of your partner users. This is only available when a partner portal is enabled for your organization.
All of your own groups. This is only available when creating other personal groups.
All roles defined for your organization’s partner portal or Customer Portal. This includes all users in the specified portal role, except high-volume portal users.
Note: A portal role name includes the name of the account that it’s associated with, except for person accounts, which
.
All roles defined for your organization’s partner portal or Customer Portal. This includes all of the users in the specified portal role plus all of the users below that role in the portal role hierarchy, except for high-volume portal users.
EDITIONS
Available in: Salesforce
Classic
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, and Developer
Editions
The member types that are available vary depending on your Edition.
USER PERMISSIONS
To create or edit a public group:
•
Manage Users
To create or edit another user’s personal group:
•
Manage Users
319
Set Up and Maintain Your Salesforce Organization
Member Type
Public Groups
Roles
Roles and Internal Subordinates
Roles and Subordinates
Roles, Internal and Portal Subordinates
Users
SEE ALSO:
Sharing Records with Manager Groups
What Is a Group?
Description
Note: A portal role name includes the name of the account that it’s associated with, except for person accounts, which
All public groups defined by your administrator.
All roles defined for your organization. Adding a role to a group includes all of the users in that role, but does not include portal roles.
Adding a role and its subordinate roles includes all of the users in that role plus all of the users in roles below that role. This doesn't include portal roles or users.
Adding a role and its subordinate roles includes all of the users in that role plus all of the users in roles below that role. This is only available when no portals are enabled for your organization.
Adding a role and its subordinate roles includes all of the users in that role plus all of the users in roles below that role. This is only available when a partner or Customer Portal is enabled for your organization. This includes portal users.
All users in your organization. This doesn't include portal users.
320
Set Up and Maintain Your Salesforce Organization What Is a Group?
Create and Edit Groups
Only administrators and delegated administrators can create and edit public groups, but anyone can create and edit their own personal groups.
To create or edit a group:
1. Click the control that matches the type of group:
•
For personal groups, go to your personal settings and click My Personal Information or
Personal—whichever one appears. Then click My Groups. The Personal Groups related list is also available on the user detail page.
•
For public groups, from Setup, enter
Public Groups
in the
Quick Find
box, then select Public Groups.
2. Click New, or click Edit next to the group you want to edit.
3. Enter the following:
Field
Label
Description
The name used to refer to the group in any user interface pages.
Group Name
(public groups only) The unique name used by the API and managed packages.
Grant Access Using
Hierarchies
(public groups only)
Select Grant Access Using Hierarchies to allow automatic access to records using your role hierarchies.
When selected, any records shared with users in this group are also shared with users higher in the hierarchy.
Deselect Grant Access Using Hierarchies if you’re creating a public group with All Internal Users as members, which optimizes performance for sharing records with groups.
Note:
If Grant Access Using Hierarchies is deselected, users that are higher in the role hierarchy don’t receive automatic access.
However, some users—such as those with the
“View All” and “Modify All” object permissions and the “View All Data” and “Modify All Data” system permissions—can still access records they don’t own.
Search
From the
Search
drop-down list, select the type of member to add. If you don’t see the member you want to add, enter keywords in the search box and click Find.
Note:
For account owners to see child records owned by high-volume portal users, they must be members of any portal share groups with access to the portal users' data.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, and Developer
Editions
USER PERMISSIONS
To create or edit a public group:
•
Manage Users
To create or edit another user’s personal group:
•
Manage Users
321
Set Up and Maintain Your Salesforce Organization
Selected Members
Selected Delegated Groups
What Is a Group?
Select members from the Available Members box, and click Add to add them to the group.
In this list, specify any delegated administration groups whose members can add or remove members from this public group. Select groups from the
Available Delegated Groups box, and then click Add. This list appears only in public groups.
4. Click Save.
Note: When you edit groups, roles, and territories, sharing rules are recalculated to add or remove access as needed.
SEE ALSO:
Viewing Group Lists
1. Click the control that matches the type of group.
•
For personal groups, in your personal settings, click My Personal Information or
Personal—whichever one appears. Then click My Groups.
•
For public groups, from Setup, enter
Public Groups
in the
Quick Find
box, then select Public Groups.
2. Click the name of a group in the Groups related list to display the group's detail page.
•
To edit the group membership, click Edit.
•
To delete the group, click Delete.
•
To view active group members, see the Group Members related list.
•
To view all group members and users who have equivalent access because they are higher in the role or territory hierarchy, click View All Users to display the All Users in Group related list. Click View Group Members to return to the Group Members related list.
EDITIONS
Available in: Salesforce
Classic
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
USER PERMISSIONS
To edit a public group:
•
Manage Users
SEE ALSO:
Sharing Records with Manager Groups
Share records up or down the management chain using sharing rules or manual sharing.
The role hierarchy controls the level of visibility that users have into your organization’s data. With
Spring ’15, you can use manager groups to share records with your management chain, instead of all managers in the same role based on the role hierarchy. Manager groups can be used wherever other groups are used, such as in a manual share or sharing rule. But they cannot be added to other groups and don’t include portal users. Manager groups can contain Standard and Chatter Only users only.
EDITIONS
Available in: Salesforce
Classic
Available in: Professional,
Enterprise, Performance,
Unlimited, and Developer
Editions
322
Set Up and Maintain Your Salesforce Organization What Is a Group?
Every user has two manager groups—Managers Group (1) and Manager Subordinates Group (2)— where (1) includes a user’s direct and indirect managers, and (2) includes a user and the user’s direct and indirect reports. On a sharing rule setup page, these groups are available on the Share with drop-down list.
To find out who a user’s manager is, from Setup, enter
Users
in the
Quick Find
box, then select Users. Click a user’s name. The
Manager
field on the user detail page displays the user’s manager.
To enable users to share records with the manager groups, follow these steps.
1. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing Settings.
2. On the Sharing Settings page, click Edit.
3. In Other Settings, select
Manager Groups
and then click Save.
Note:
You can’t disable manager groups if your organization uses Work.com or have any sharing rules that uses manager groups.
With manager groups, you can share records to these groups via manual sharing, sharing rules, and Apex managed sharing. Apex sharing reasons is not supported. For Apex managed sharing, include the row cause ID, record ID, and the manager group ID. For more information, see the
Force.com Apex Code Developer's Guide
.
Inactive users remain in the groups of which they are members, but all relevant sharing rules and manual sharing are retained in the groups.
Note:
If your organization has User Sharing enabled, you can’t see the users whom you don’t have access to. Additionally, a querying user who doesn’t have access to another user can’t query that user’s groups.
Example: You might have a custom object for performance reviews whose organization-wide default is set to Private. After deselecting the
Grant Access Using Hierarchies
checkbox, only the employee who owns the review record can
323
Set Up and Maintain Your Salesforce Organization Sharing Rules view and edit it. To share the reviews up the management chain, administrators can create a sharing rule that shares to a user’s
Managers Group. Alternatively, the employee can share the review record with the user’s Managers Group by using manual sharing.
SEE ALSO:
Sharing Rules
Make automatic exceptions to your organization-wide sharing settings for defined sets of users.
Note: Who Sees What: Record Access via Sharing Rules (Salesforce Classic)
Watch how you can grant access to records using sharing rules.
For example, use sharing rules to extend sharing access to users in public groups, roles, or territories.
Sharing rules can never be stricter than your organization-wide default settings. They simply allow greater access for particular users.
You can create these types of sharing rules.
Type
Account territory sharing rules
Asset sharing rules
Territory assignment Accounts and their associated cases, contacts, contracts, and opportunities
Asset owner or other criteria, including asset record types or field values
Individual asset records
Based on Set Default Sharing
Access for
Account owner or other criteria, including account record types or field values
Accounts and their associated contracts, opportunities, cases, and optionally, contacts and orders
Campaign owner or other criteria, including campaign record types or field values
Individual campaign records
Case owner or other criteria, including case record types or field values
Individual cases and associated accounts
Contact owner or other criteria, including contact record types or field values
Individual contacts and associated accounts
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Account, asset, and contact sharing rules are available in: Professional, Enterprise,
Performance, Unlimited, and Developer Editions
Account territory, case, lead, opportunity, order, and custom object sharing rules are available in: Enterprise,
Performance, Unlimited, and Developer Editions
Campaign sharing rules are available in Enterprise,
Performance, Unlimited, and Developer Editions and in Professional Edition for an additional cost
Record types are available in Professional, Enterprise,
Performance, Unlimited, and Developer Editions
324
Set Up and Maintain Your Salesforce Organization Sharing Rules
Type
User provisioning request sharing rules
Based on
Custom object owner or other criteria, including custom object record types or field values
Set Default Sharing Access for
Individual custom object records
Lead owner or other criteria, including lead record types or field values
Individual leads
Opportunity owner or other criteria, including opportunity record types or field values
Individual opportunities and their associated accounts
Order owner or other criteria, including order record types or field values
Individual orders
Group membership or other criteria, including username and whether the user is active
Individual user records
User provisioning request owner, only; criteria-based sharing rules aren’t available
Individual user provisioning request records
Work order owner or other criteria, including work order record types or field values
Individual work orders
Note:
•
You can’t include high-volume portal users in sharing rules because they don’t have roles and can’t be in public groups.
•
Developers can use Apex to programmatically share custom objects (based on record owners, but not other criteria). This does not apply to User Sharing.
SEE ALSO:
325
Set Up and Maintain Your Salesforce Organization Sharing Rules
Criteria-Based Sharing Rules
Criteria-based sharing rules determine whom to share records with based on field values in records.
For example, let’s say you use a custom object for job applications, with a custom picklist field named “Department.” A criteria-based sharing rule could share all job applications in which the
Department field is set to “IT” with all IT managers in your organization.
Note:
•
Although criteria-based sharing rules are based on values in the records and not the record owners, a role or territory hierarchy still allows users higher in the hierarchy to access the records.
•
You can’t use Apex to create criteria-based sharing rules. Also, criteria-based sharing cannot be tested using Apex.
•
You can use the SharingRules type in the Metadata API to create criteria-based sharing rules starting in API version 24.0.
•
You can’t include high-volume portal users in sharing rules because they don’t have roles and can’t be in public groups.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
Accounts, Opportunities,
Cases, Contacts, and record types are not available in
Database.com
You can create criteria-based sharing rules for accounts, assets, opportunities, cases, contacts, leads, campaigns, work orders, and custom objects. You can create up to 50 criteria-based sharing rules per object.
•
Record types
•
These field types:
–
Auto Number
–
Checkbox
–
Date
–
Date/Time
–
–
Number
–
Percent
–
Phone
–
Picklist
–
Text
–
Text Area
–
URL
–
Lookup Relationship (to user ID or queue ID)
Note: Text and Text Area are case-sensitive. For example, a criteria-based sharing rule that specifies “Manager” in a text field doesn’t share records that have “manager” in the field. To create a rule with several common cases of a word, enter each value separated by a comma.
SEE ALSO:
326
Set Up and Maintain Your Salesforce Organization Sharing Rules
Sharing Rule Categories
When you define a sharing rule, you can choose from the following categories in the owned by members of
and
Share with
drop-down lists. Depending on the type of sharing rule and the features enabled for your organization, some categories may not appear.
Note: You can’t include high-volume portal users in sharing rules because they don’t have roles and can’t be in public groups.
Category
Managers Groups
Manager Subordinates
Groups
Queues
Description
All direct and indirect managers of a user.
A manager and all direct and indirect reports who he or she manages.
Public Groups
Roles
Portal Roles
All records owned by the queue, excluding records owned by individual members of the queue. Available only in the owned by members of
list.
All public groups defined by your administrator.
If a partner portal or Customer Portal is enabled for your organization, the All Partner Users or All Customer Portal Users group displays.
These groups includes all users allowed to access your partner portal or Customer Portal, except for high-volume portal users.
All roles defined for your organization. This includes all of the users in the specified role.
All roles defined for your organization’s partner portal or Customer
Portal. This includes all users in the specified portal role, except high-volume portal users.
A portal role name includes the name of the account that it’s associated with, except for person accounts, which include the user
Roles and Subordinates
Portal Roles and
Subordinates
All roles defined for your organization. This includes all of the users in the specified role plus all of the users in roles below that role, including partner portal and Customer Portal roles that contain users with a portal license type.
Portal roles are only included in this category if a partner portal or
Customer Portal is enabled for your organization.
The Roles, Internal and Portal Subordinates data set category is only available in your organization after you create at least one role in the role hierarchy.
All roles defined for your organization’s partner portal or Customer
Portal. This includes all of the users in the specified portal role plus all of the users below that role in the portal role hierarchy, except for high-volume portal users.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Account and contact sharing rules available in:
Professional, Enterprise,
Performance, Unlimited, and Developer Editions
Account territory, case, lead, and opportunity sharing rules available in:
Enterprise, Performance,
Unlimited, and Developer
Editions
Campaign sharing rules available in Professional
Edition for an additional cost, and Enterprise,
Performance, Unlimited, and Developer Editions
Custom object sharing rules available in: Enterprise,
Performance, Unlimited,
Developer, and
Database.com Editions.
Partner Portals and
Customer Portals available in Salesforce Classic
327
Set Up and Maintain Your Salesforce Organization Sharing Rules
Category
Roles and Internal Subordinates
Roles, Internal and Portal
Subordinates
Territories
Territories and Subordinates
Description
A portal role name includes the name of the account that it’s associated with, except for person accounts, which include the user
All roles defined for your organization. This includes all of the users in the specified role plus all of the users in roles below that role, excluding partner portal and Customer Portal roles.
This category only displays if a partner portal or Salesforce Customer Portal is enabled for your organization.
The Roles and Internal Subordinates data set category is only available in your organization after you create at least one role in the role hierarchy and enable a portal.
All roles defined for your organization. This includes all of the users in the specified role plus all of the users in roles below that role, including partner portal and Customer Portal roles.
This category only displays if a partner portal or Salesforce Customer Portal is enabled for your organization.
The Roles and Internal Subordinates data set category is only available in your organization after you create at least one role in the role hierarchy and enable a portal.
All territories defined for your organization.
All territories defined for your organization. This includes the specified territory plus all territories below it.
SEE ALSO:
Sharing Records with Manager Groups
Creating Lead Sharing Rules
Lead sharing rules are based on the record owner or on other criteria, including record type and certain field values. You can define up to 300 lead sharing rules, including up to 50 criteria-based sharing rules.
1. If you plan to include public groups in your sharing rule, confirm that the appropriate groups have been created.
2. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing
Settings.
3. In the Lead Sharing Rules related list, click New.
4. Enter the Label Name and Rule Name. The Label is the sharing rule label as it appears on the user interface. The Rule Name is a unique name used by the API and managed packages.
5. Enter the Description. This field describes the sharing rule. It is optional and can contain up to
1000 characters.
6. Select a rule type.
7. Depending on the rule type you selected, do the following:
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Enterprise,
Performance, Unlimited, and Developer Editions
USER PERMISSIONS
To create sharing rules:
•
Manage Sharing
328
Set Up and Maintain Your Salesforce Organization Sharing Rules
•
Based on record owner
—In the owned by members of
line, specify the users whose records will be shared: select a category from the first drop-down list and a set of users from the second drop-down list (or lookup field, if your organization has over 200 queues, groups, roles, or territories).
•
Based on criteria
—Specify the Field, Operator, and Value criteria that records must match to be included in the sharing rule. The fields available depend on the object selected, and the value is always a literal number or string. Click Add Filter Logic... to change the default AND relationship between each filter.
Note: To use a field that’s not supported by criteria-based sharing rules, you can create a workflow rule or Apex trigger to copy the value of the field into a text or numeric field, and use that field as the criterion.
8. In the
Share with
line, specify the users who get access to the data: select a category from the first drop-down list and a set of users from the second drop-down list or lookup field.
9. Select the sharing access setting for users.
Access Setting
Read Only
Read/Write
Description
Users can view, but not update, records.
Users can view and update records.
10. Click Save.
SEE ALSO:
Editing Lead Sharing Rules
For sharing rules that are based on owner, you can edit only the sharing access settings. For sharing rules that are based on other criteria, you can edit the criteria and sharing access settings.
1. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing
Settings.
2. In the Lead Sharing Rules related list, click Edit next to the rule you want to change.
3. Change the Label and Rule Name if desired.
4. If you selected a rule that's based on owner, skip to the next step.
If you selected a rule that's based on criteria, specify the criteria that records must match to be included in the sharing rule. The fields available depend on the object selected, and the value must be a literal number or string. Click Add Filter Logic... to change the default AND relationship between each filter.
5. Select the sharing access setting for users.
Access Setting
Read Only
Description
Users can view, but not update, records.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Enterprise,
Performance, Unlimited, and Developer Editions
USER PERMISSIONS
To edit sharing rules:
•
Manage Sharing
329
Set Up and Maintain Your Salesforce Organization
Access Setting
Read/Write
Description
Users can view and update records.
Sharing Rules
6. Click Save.
SEE ALSO:
Creating Account Sharing Rules
Account sharing rules can be based on the record owner or on other criteria, including record type and certain field values. You can define up to 300 account sharing rules, including up to 50 criteria-based sharing rules.
EDITIONS
1. If you plan to include public groups in your sharing rule, confirm that the appropriate groups have been created.
2. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing
Settings.
3. In the Account Sharing Rules related list, click New.
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, and Developer
Editions
4. Enter the Label Name and Rule Name. The Label is the sharing rule label as it appears on the user interface. The Rule Name is a unique name used by the API and managed packages.
5. Enter the Description. This field describes the sharing rule. It is optional and can contain up to
1000 characters.
USER PERMISSIONS
To create sharing rules:
•
Manage Sharing
6. Select a rule type.
7. Depending on the rule type you selected, do the following:
•
Based on record owner
—In the owned by members of
line, specify the users whose records will be shared: select a category from the first drop-down list and a set of users from the second drop-down list (or lookup field, if your organization has over 200 queues, groups, roles, or territories).
•
Based on criteria
—Specify the Field, Operator, and Value criteria that records must match to be included in the sharing rule. The fields available depend on the object selected, and the value is always a literal number or string. Click Add Filter Logic... to change the default AND relationship between each filter.
Note: To use a field that’s not supported by criteria-based sharing rules, you can create a workflow rule or Apex trigger to copy the value of the field into a text or numeric field, and use that field as the criterion.
8. In the
Share with
line, specify the users who get access to the data: select a category from the first drop-down list and a set of users from the second drop-down list or lookup field.
9. Select a setting for
Default Account, Contract and Asset Access
.
10. In the remaining fields, select the access settings for the records associated with the shared accounts.
330
Set Up and Maintain Your Salesforce Organization Sharing Rules
Access Setting Description
Private
(available for associated contacts, opportunities, and cases only)
Users can’t view or update records, unless access is granted outside of this sharing rule.
Read Only
Read/Write
Users can view, but not update, records.
Users can view and update records.
Note:
Contact Access
is not available when the organization-wide default for contacts is set to Controlled by Parent.
11. Click Save.
SEE ALSO:
Editing Account Sharing Rules
For sharing rules that are based on owner, you can edit only the sharing access settings. For sharing rules that are based on other criteria, you can edit the criteria and sharing access settings.
1. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing
Settings.
2. In the Account Sharing Rules related list, click Edit next to the rule you want to change.
3. Change the Label and Rule Name if desired.
4. If you selected a rule that's based on owner, skip to the next step.
If you selected a rule that's based on criteria, specify the criteria that records must match to be included in the sharing rule. The fields available depend on the object selected, and the value must be a literal number or string. Click Add Filter Logic... to change the default AND relationship between each filter.
5. Select a setting for
Default Account, Contract and Asset Access
.
6. In the remaining fields, select the access settings for the records associated with the shared accounts.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, and Developer
Editions
USER PERMISSIONS
To edit sharing rules:
•
Manage Sharing
Access Setting Description
Private
(available for associated contacts, opportunities, and cases only)
Users can’t view or update records, unless access is granted outside of this sharing rule.
Read Only
Read/Write
Users can view, but not update, records.
Users can view and update records.
331
Set Up and Maintain Your Salesforce Organization Sharing Rules
Note:
Contact Access
is not available when the organization-wide default for contacts is set to Controlled by Parent.
7. Click Save.
SEE ALSO:
Creating Account Territory Sharing Rules
Account territory sharing rules are based on territory assignment. You can define up to 300 account territory sharing rules.
1. If you plan to include public groups in your sharing rule, confirm that the appropriate groups have been created.
2. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing
Settings.
3. In the Account Territory Sharing Rules related list, click New.
4. Enter the Label Name and Rule Name. The Label is the sharing rule label as it appears on the user interface. The Rule Name is a unique name used by the API and managed packages.
5. Enter the Description. This field describes the sharing rule. It is optional and can contain up to
1000 characters.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Enterprise,
Performance, Unlimited, and Developer Editions
USER PERMISSIONS
To create sharing rules:
•
Manage Sharing
6. In the Accounts in Territory line, select Territories or Territories and Subordinates from the first drop-down list and a territory from the second drop-down list.
7. In the
Share with
line, specify the users who get access to the data: select a category from the first drop-down list and a set of users from the second drop-down list or lookup field.
8. Select a setting for
Default Account, Contract and Asset Access
.
9. In the remaining fields, select the access setting for the records associated with the shared account territories.
Access Setting Description
Private
(available for associated contacts, opportunities, and cases only)
Users can’t view or update records, unless access is granted outside of this sharing rule.
Read Only
Read/Write
Users can view, but not update, records.
Users can view and update records.
Note:
Contact Access
is not available when the organization-wide default for contacts is set to Controlled by Parent.
332
Set Up and Maintain Your Salesforce Organization Sharing Rules
10. Click Save.
SEE ALSO:
Editing Account Territory Sharing Rules
For account territory sharing rules, you can edit the sharing access settings, but no other settings.
1. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing
Settings.
2. In the Account Territory Sharing Rules related list, click Edit next to the rule you want to change.
3. Change the Label and Rule Name if desired.
4. Select the sharing access setting for users.
Access Setting
Private
(available for associated contacts, opportunities, and cases only)
Read Only
Read/Write
Description
Users can’t view or update records, unless access is granted outside of this sharing rule.
Users can view, but not update, records.
Users can view and update records.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Enterprise,
Performance, Unlimited, and Developer Editions
USER PERMISSIONS
To edit sharing rules:
•
Manage Sharing
Note:
Contact Access
is not available when the organization-wide default for contacts is set to Controlled by Parent.
5. Click Save.
SEE ALSO:
333
Set Up and Maintain Your Salesforce Organization Sharing Rules
Creating Contact Sharing Rules
Contact sharing rules can be based on the record owner or on other criteria, including record type and certain field values. You can define up to 300 contact sharing rules, including up to 50 criteria-based sharing rules.
1. If you plan to include public groups in your sharing rule, confirm that the appropriate groups have been created.
2. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing
Settings.
3. In the Contact Sharing Rules related list, click New.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, and Developer
Editions
4. Enter the Label Name and Rule Name. The Label is the sharing rule label as it appears on the user interface. The Rule Name is a unique name used by the API and managed packages.
5. Enter the Description. This field describes the sharing rule. It is optional and can contain up to
1000 characters.
6. Select a rule type.
7. Depending on the rule type you selected, do the following:
USER PERMISSIONS
To create sharing rules:
•
Manage Sharing
•
Based on record owner
—In the owned by members of
line, specify the users whose records will be shared: select a category from the first drop-down list and a set of users from the second drop-down list (or lookup field, if your organization has over 200 queues, groups, roles, or territories).
•
Based on criteria
—Specify the Field, Operator, and Value criteria that records must match to be included in the sharing rule. The fields available depend on the object selected, and the value is always a literal number or string. Click Add Filter Logic... to change the default AND relationship between each filter.
Note: To use a field that’s not supported by criteria-based sharing rules, you can create a workflow rule or Apex trigger to copy the value of the field into a text or numeric field, and use that field as the criterion.
8. In the
Share with
line, specify the users who get access to the data: select a category from the first drop-down list and a set of users from the second drop-down list or lookup field.
9. Select the sharing access setting for users.
Access Setting
Read Only
Read/Write
Description
Users can view, but not update, records.
Users can view and update records.
10. Click Save.
SEE ALSO:
334
Set Up and Maintain Your Salesforce Organization Sharing Rules
Editing Contact Sharing Rules
For sharing rules that are based on owner, you can edit only the sharing access settings. For sharing rules that are based on other criteria, you can edit the criteria and sharing access settings.
1. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing
Settings.
2. In the Contact Sharing Rules related list, click Edit next to the rule you want to change.
3. Change the Label and Rule Name if desired.
4. If you selected a rule that's based on owner, skip to the next step.
If you selected a rule that's based on criteria, specify the criteria that records must match to be included in the sharing rule. The fields available depend on the object selected, and the value must be a literal number or string. Click Add Filter Logic... to change the default AND relationship between each filter.
5. Select the sharing access setting for users.
Access Setting
Read Only
Read/Write
Description
Users can view, but not update, records.
Users can view and update records.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, and Developer
Editions
USER PERMISSIONS
To edit sharing rules:
•
Manage Sharing
6. Click Save.
SEE ALSO:
Creating Opportunity Sharing Rules
Opportunity sharing rules can be based on the record owner or on other criteria, including record type and certain field values. You can define up to 300 opportunity sharing rules, including up to
50 criteria-based sharing rules.
1. If you plan to include public groups in your sharing rule, confirm that the appropriate groups have been created.
2. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing
Settings.
3. In the Opportunity Sharing Rules related list, click New.
4. Enter the Label Name and Rule Name. The Label is the sharing rule label as it appears on the user interface. The Rule Name is a unique name used by the API and managed packages.
5. Enter the Description. This field describes the sharing rule. It is optional and can contain up to
1000 characters.
6. Select a rule type.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Enterprise,
Performance, Unlimited, and Developer Editions
USER PERMISSIONS
To create sharing rules:
•
Manage Sharing
335
Set Up and Maintain Your Salesforce Organization Sharing Rules
7. Depending on the rule type you selected, do the following:
•
Based on record owner
—In the owned by members of
line, specify the users whose records will be shared: select a category from the first drop-down list and a set of users from the second drop-down list (or lookup field, if your organization has over 200 queues, groups, roles, or territories).
•
Based on criteria
—Specify the Field, Operator, and Value criteria that records must match to be included in the sharing rule. The fields available depend on the object selected, and the value is always a literal number or string. Click Add Filter Logic... to change the default AND relationship between each filter.
Note: To use a field that’s not supported by criteria-based sharing rules, you can create a workflow rule or Apex trigger to copy the value of the field into a text or numeric field, and use that field as the criterion.
8. In the
Share with
line, specify the users who get access to the data: select a category from the first drop-down list and a set of users from the second drop-down list or lookup field.
9. Select the sharing access setting for users. For owner-based rules or criteria-based rules with ownership as criteria, the
Opportunity
Access
level applies to opportunities owned by the group, role, or territory members, regardless of the associated account.
Access Setting
Read Only
Read/Write
Description
Users can view, but not update, records.
Users can view and update records.
10. Click Save.
SEE ALSO:
Editing Opportunity Sharing Rules
For sharing rules that are based on owner, you can edit only the sharing access settings. For sharing rules that are based on other criteria, you can edit the criteria and sharing access settings.
1. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing
Settings.
2. In the Opportunity Sharing Rules related list, click Edit next to the rule you want to change.
3. Change the Label and Rule Name if desired.
4. If you selected a rule that's based on owner, skip to the next step.
If you selected a rule that's based on criteria, specify the criteria that records must match to be included in the sharing rule. The fields available depend on the object selected, and the value must be a literal number or string. Click Add Filter Logic... to change the default AND relationship between each filter.
5. Select the sharing access setting for users. For owner-based rules or criteria-based rules with ownership as criteria, the
Opportunity Access
level applies to opportunities owned by the group, role, or territory members, regardless of the associated account.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Enterprise,
Performance, Unlimited, and Developer Editions
USER PERMISSIONS
To edit sharing rules:
•
Manage Sharing
336
Set Up and Maintain Your Salesforce Organization
Access Setting
Read Only
Read/Write
Description
Users can view, but not update, records.
Users can view and update records.
Sharing Rules
6. Click Save.
SEE ALSO:
Creating Case Sharing Rules
Case sharing rules can be based on the record owner or on other criteria, including record type and certain field values. You can define up to 300 case sharing rules, including up to 50 criteria-based sharing rules.
1. If you plan to include public groups in your sharing rule, confirm that the appropriate groups have been created.
2. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing
Settings.
3. In the Case Sharing Rules related list, click New.
4. Enter the Label Name and Rule Name. The Label is the sharing rule label as it appears on the user interface. The Rule Name is a unique name used by the API and managed packages.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Enterprise,
Performance, Unlimited, and Developer Editions
USER PERMISSIONS
5. Enter the Description. This field describes the sharing rule. It is optional and can contain up to
1000 characters.
6. Select a rule type.
To create sharing rules:
•
Manage Sharing
7. Depending on the rule type you selected, do the following:
•
Based on record owner
—In the owned by members of
line, specify the users whose records will be shared: select a category from the first drop-down list and a set of users from the second drop-down list (or lookup field, if your organization has over 200 queues, groups, roles, or territories).
•
Based on criteria
—Specify the Field, Operator, and Value criteria that records must match to be included in the sharing rule. The fields available depend on the object selected, and the value is always a literal number or string. Click Add Filter Logic... to change the default AND relationship between each filter.
Note: To use a field that’s not supported by criteria-based sharing rules, you can create a workflow rule or Apex trigger to copy the value of the field into a text or numeric field, and use that field as the criterion.
8. In the
Share with
line, specify the users who get access to the data: select a category from the first drop-down list and a set of users from the second drop-down list or lookup field.
9. Select the sharing access setting for users.
337
Set Up and Maintain Your Salesforce Organization
Access Setting
Read Only
Read/Write
Description
Users can view, but not update, records.
Users can view and update records.
Sharing Rules
10. Click Save.
SEE ALSO:
Editing Case Sharing Rules
For sharing rules that are based on owner, you can edit only the sharing access settings. For sharing rules that are based on other criteria, you can edit the criteria and sharing access settings.
1. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing
Settings.
2. In the Case Sharing Rules related list, click Edit next to the rule you want to change.
3. Change the Label and Rule Name if desired.
4. If you selected a rule that's based on owner, skip to the next step.
If you selected a rule that's based on criteria, specify the criteria that records must match to be included in the sharing rule. The fields available depend on the object selected, and the value must be a literal number or string. Click Add Filter Logic... to change the default AND relationship between each filter.
5. Select the sharing access setting for users.
Access Setting
Read Only
Read/Write
Description
Users can view, but not update, records.
Users can view and update records.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Enterprise,
Performance, Unlimited, and Developer Editions
USER PERMISSIONS
To edit sharing rules:
•
Manage Sharing
6. Click Save.
SEE ALSO:
338
Set Up and Maintain Your Salesforce Organization Sharing Rules
Creating Campaign Sharing Rules
Campaign sharing rules can be based on the record owner or on other criteria, including record type and certain field values. You can define up to 300 campaign sharing rules, including up to 50 criteria-based sharing rules.
1. If you plan to include public groups in your sharing rule, confirm that the appropriate groups have been created.
2. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing
Settings.
3. In the Campaign Sharing Rules related list, click New.
EDITIONS
Available in: Salesforce
Classic
Available in: Professional
Edition for an additional cost, and Enterprise,
Performance, Unlimited, and Developer Editions
4. Enter the Label Name and Rule Name. The Label is the sharing rule label as it appears on the user interface. The Rule Name is a unique name used by the API and managed packages.
5. Enter the Description. This field describes the sharing rule. It is optional and can contain up to
1000 characters.
6. Select a rule type.
7. Depending on the rule type you selected, do the following:
USER PERMISSIONS
To create sharing rules:
•
Manage Sharing
•
Based on record owner
—In the owned by members of
line, specify the users whose records will be shared: select a category from the first drop-down list and a set of users from the second drop-down list (or lookup field, if your organization has over 200 queues, groups, roles, or territories).
•
Based on criteria
—Specify the Field, Operator, and Value criteria that records must match to be included in the sharing rule. The fields available depend on the object selected, and the value is always a literal number or string. Click Add Filter Logic... to change the default AND relationship between each filter.
Note: To use a field that’s not supported by criteria-based sharing rules, you can create a workflow rule or Apex trigger to copy the value of the field into a text or numeric field, and use that field as the criterion.
8. In the
Share with
line, specify the users who get access to the data: select a category from the first drop-down list and a set of users from the second drop-down list or lookup field.
9. Select the sharing access setting for users.
Access Setting
Read Only
Read/Write
Full Access
Description
Users can view, but not update, records.
Users can view and update records.
Any user in the selected group, role, or territory can view, edit, transfer, delete, and share the record, just like the record’s owner.
With a Full Access sharing rule, users can also view, edit, delete, and close activities associated with the record if the organization-wide sharing setting for activities is
Controlled by Parent.
339
Set Up and Maintain Your Salesforce Organization Sharing Rules
10. Click Save.
SEE ALSO:
Editing Campaign Sharing Rules
For sharing rules that are based on owner, you can edit only the sharing access settings. For sharing rules that are based on other criteria, you can edit the criteria and sharing access settings.
1. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing
Settings.
2. In the Campaign Sharing Rules related list, click Edit next to the rule you want to change.
3. Change the Label and Rule Name if desired.
4. If you selected a rule that's based on owner, skip to the next step.
If you selected a rule that's based on criteria, specify the criteria that records must match to be included in the sharing rule. The fields available depend on the object selected, and the value must be a literal number or string. Click Add Filter Logic... to change the default AND relationship between each filter.
5. Select the sharing access setting for users.
Access Setting
Read Only
Read/Write
Full Access
Description
Users can view, but not update, records.
Users can view and update records.
Any user in the selected group, role, or territory can view, edit, transfer, delete, and share the record, just like the record’s owner.
With a Full Access sharing rule, users can also view, edit, delete, and close activities associated with the record if the organization-wide sharing setting for activities is Controlled by Parent.
EDITIONS
Available in: Salesforce
Classic
Available in: Professional
Edition for an additional cost, and Enterprise,
Performance, Unlimited, and Developer Editions
USER PERMISSIONS
To edit sharing rules:
•
Manage Sharing
6. Click Save.
SEE ALSO:
340
Set Up and Maintain Your Salesforce Organization Sharing Rules
Creating Quick Text Sharing Rules
To create Quick Text sharing rules:
1. If you plan to include public groups in your sharing rule, confirm that the appropriate groups have been created.
2. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing
Settings.
3. In the Quick Text Sharing Rules related list, click New.
4. Enter the Label Name and Rule Name. The Label is the sharing rule label as it appears on the user interface. The Rule Name is a unique name used by the API and managed packages.
5. Enter the Description. This field describes the sharing rule. It is optional and can contain up to
1000 characters.
6. In the
Quick Text: owned by members of
line, specify the users who own the data by selecting a category from the first drop-down list and a set of users from the second drop-down list.
EDITIONS
Available in: Salesforce
Classic
Available in: Enterprise,
Performance, Unlimited, and Developer Editions
USER PERMISSIONS
To create sharing rules:
•
Manage Sharing
7. In the
Share with
line, specify the users who get access to the data: select a category from the first drop-down list and a set of users from the second drop-down list or lookup field.
8. Select the sharing access setting for users.
Access Setting
Read Only
Read/Write
Description
Users can view, but not update, records.
Users can view and update records.
9. Click Save.
SEE ALSO:
341
Set Up and Maintain Your Salesforce Organization Sharing Rules
Creating Custom Object Sharing Rules
Custom object sharing rules can be based on the record owner or on other criteria, including record type and certain field values. You can define up to 300 custom object sharing rules, including up to 50 criteria-based sharing rules.
1. If you plan to include public groups in your sharing rule, confirm that the appropriate groups have been created.
2. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing
Settings.
3. In the Sharing Rules related list for the custom object, click New.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Enterprise,
Performance, Unlimited,
Developer, and
Database.com Editions
4. Enter the Label and Rule Name. The Label is the sharing rule label as it appears on the user interface. The Rule Name is a unique name used by the API and managed packages.
5. Enter the Description. This field describes the sharing rule. It is optional and can contain up to
1000 characters.
6. Select a rule type.
7. Depending on the rule type you selected, do the following:
USER PERMISSIONS
To create sharing rules:
•
Manage Sharing
•
Based on record owner
—In the owned by members of
line, specify the users whose records will be shared: select a category from the first drop-down list and a set of users from the second drop-down list (or lookup field, if your organization has over 200 queues, groups, roles, or territories).
•
Based on criteria
—Specify the Field, Operator, and Value criteria that records must match to be included in the sharing rule. The fields available depend on the object selected, and the value is always a literal number or string. Click Add Filter Logic... to change the default AND relationship between each filter.
Note: To use a field that’s not supported by criteria-based sharing rules, you can create a workflow rule or Apex trigger to copy the value of the field into a text or numeric field, and use that field as the criterion.
8. In the
Share with
line, specify the users who get access to the data: select a category from the first drop-down list and a set of users from the second drop-down list or lookup field.
9. Select the sharing access setting for users.
Access Setting
Read Only
Read/Write
Description
Users can view, but not update, records.
Users can view and update records.
10. Click Save.
SEE ALSO:
342
Set Up and Maintain Your Salesforce Organization Sharing Rules
Editing Custom Object Sharing Rules
For sharing rules that are based on owner, you can edit only the sharing access settings. For sharing rules that are based on other criteria, you can edit the criteria and sharing access settings.
1. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing
Settings.
2. In the Sharing Rules related list for the custom object, click Edit next to the rule you want to change.
3. Change the Label and Rule Name if desired.
4. If you selected a rule that's based on owner, skip to the next step.
If you selected a rule that's based on criteria, specify the criteria that records must match to be included in the sharing rule. The fields available depend on the object selected, and the value must be a literal number or string. Click Add Filter Logic... to change the default AND relationship between each filter.
5. Select the sharing access setting for users.
Access Setting
Read Only
Read/Write
EDITIONS
Available in: Salesforce
Classic
Available in: Enterprise,,
Performance, Unlimited,
Developer, and
Database.com Editions.
USER PERMISSIONS
To edit sharing rules:
•
Manage Sharing
Description
Users can view, but not update, records.
Users can view and update records.
6. Click Save.
SEE ALSO:
Create Order Sharing Rules
Order sharing rules can be based on the record owner or on other criteria, including record type and certain field values. You can define up to 300 order sharing rules, including up to 50 criteria-based sharing rules.
1. If you plan to include public groups in your sharing rule, confirm that the appropriate groups have been created.
2. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing
Settings.
3. In the Order Sharing Rules related list, click New.
4. Enter the Label Name and Rule Name. The Label is the sharing rule label as it appears on the user interface. The Rule Name is a unique name used by the API and managed packages.
5. Enter the Description. This field describes the sharing rule. It is optional and can contain up to
1000 characters.
EDITIONS
Available in: Salesforce
Classic
Available in: Enterprise,
Performance, Unlimited, and Developer Editions
USER PERMISSIONS
To create sharing rules:
•
Manage Sharing
343
Set Up and Maintain Your Salesforce Organization Sharing Rules
6. Select a rule type.
7. Depending on the rule type you selected, do the following:
•
Based on record owner
—In the owned by members of
line, specify the users whose records will be shared: select a category from the first drop-down list and a set of users from the second drop-down list (or lookup field, if your organization has over 200 queues, groups, roles, or territories).
•
Based on criteria
—Specify the Field, Operator, and Value criteria that records must match to be included in the sharing rule. The fields available depend on the object selected, and the value is always a literal number or string. Click Add Filter Logic... to change the default AND relationship between each filter.
Note: To use a field that’s not supported by criteria-based sharing rules, you can create a workflow rule or Apex trigger to copy the value of the field into a text or numeric field, and use that field as the criterion.
8. In the
Share with
line, specify the users who get access to the data: select a category from the first drop-down list and a set of users from the second drop-down list or lookup field.
9. Select the sharing access setting for users.
Access Setting
Read Only
Read/Write
Description
Users can view, but not update, records.
Users can view and update records.
10. Click Save.
Edit Order Sharing Rules
For sharing rules that are based on owner, you can edit only the sharing access settings. For sharing rules that are based on other criteria, you can edit the criteria and sharing access settings.
1. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing
Settings.
2. In the Order Sharing Rules related list, click Edit next to the rule you want to change.
3. Change the Label and Rule Name if desired.
4. If you selected a rule that's based on owner, skip to the next step.
If you selected a rule that's based on criteria, specify the criteria that records must match to be included in the sharing rule. The fields available depend on the object selected, and the value must be a literal number or string. Click Add Filter Logic... to change the default AND relationship between each filter.
5. Select the sharing access setting for users.
Access Setting
Read Only
Read/Write
EDITIONS
Available in: Salesforce
Classic
Available in: Enterprise,
Performance, Unlimited, and Developer Editions
USER PERMISSIONS
To edit sharing rules:
•
Manage Sharing
Description
Users can view, but not update, records.
Users can view and update records.
344
Set Up and Maintain Your Salesforce Organization Sharing Rules
6. Click Save.
Creating User Provisioning Request Sharing Rules
User provisioning request sharing rules can be based on the record owner, only. You can’t create criteria-based user provisioning request sharing rules. You can define up to 300 user provisioning request sharing rules.
1. If you plan to include public groups in your sharing rule, confirm that the appropriate groups have been created.
2. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing
Settings.
3. In the User Provisioning Request Sharing Rules related list, click New.
EDITIONS
Available in: Salesforce
Classic
Available in: Enterprise,
Performance, Unlimited, and Developer Editions
4. Enter the Label Name and Rule Name. The Label is the sharing rule label as it appears on the user interface. The Rule Name is a unique name used by the API and managed packages.
5. Enter the Description. This field describes the sharing rule. It is optional and can contain up to
1000 characters.
USER PERMISSIONS
To create user provisioning request sharing rules:
•
Manage Sharing and
Use Identity Features
6. In the owned by members of
line, specify the users whose records are shared. Select a category from the first drop-down list and a set of users from the second drop-down list (or lookup field, if your organization has over 200 queues, groups, roles, or territories).
7. In the
Share with
line, specify the users who get access to the data: select a category from the first drop-down list and a set of users from the second drop-down list or lookup field.
8. Select the sharing access setting for users.
Access Setting
Read Only
Read/Write
Description
Users can view, but not update, records.
Users can view and update records.
9. Click Save.
SEE ALSO:
Editing User Provisioning Request Sharing Rules
345
Set Up and Maintain Your Salesforce Organization Sharing Rules
Editing User Provisioning Request Sharing Rules
For sharing rules that are based on an owner, you can edit only the sharing access settings. You can’t create criteria-based user provisioning request sharing rules.
1. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing
Settings.
2. In the User Provisioning Request Sharing Rules related list, click Edit next to the rule you want to change.
3. Change the Label and Rule Name if desired.
4. Select the sharing access setting for users.
Access Setting
Read Only
Read/Write
Description
Users can view, but not update, records.
Users can view and update records.
EDITIONS
Available in: Salesforce
Classic
Available in: Enterprise,
Performance, Unlimited, and Developer Editions
USER PERMISSIONS
To edit sharing rules:
•
Manage Sharing
5. Click Save.
SEE ALSO:
Create Work Order Sharing Rules
Work order sharing rules are based on the record owner or on other criteria, including record type and certain field values. You can define up to 300 work order sharing rules, including up to 50 criteria-based sharing rules.
1. If you plan to include public groups in your sharing rule, confirm that the appropriate groups have been created.
2. From Setup, enter
Sharing Settings
in the Quick Find box, then select Sharing Settings.
EDITIONS
Available in: Enterprise,
Performance, Unlimited, and Developer Editions
3. In the Work Order Sharing Rules related list, click New.
4. Enter the Label Name and click the Rule Name field to auto-populate it.
5. Enter the Description. This field describes the sharing rule. It is optional and can contain up to
1000 characters.
6. Select a rule type.
7. Depending on the rule type you selected, do the following:
USER PERMISSIONS
To create sharing rules:
•
Manage Sharing
To enable work orders:
•
Customize Application
•
Based on record owner
—In the owned by members of line, specify the users whose records are shared: select a category from the first drop-down list and a set of users from the second drop-down list (or lookup field, if your organization has over 200 queues, groups, roles, or territories).
346
Set Up and Maintain Your Salesforce Organization Sharing Rules
•
Based on criteria
—Specify the Field, Operator, and Value criteria that records must match to be included in the sharing rule. The fields available depend on the object selected, and the value is always a literal number or string. Click Add Filter Logic... to change the default AND relationship between each filter.
Note:
To use a field that’s not supported by criteria-based sharing rules, you can create a workflow rule or Apex trigger to copy the value of the field into a text or numeric field, and use that field as the criterion.
8. In the Share with line, specify the users who get access to the data: select a category from the first drop-down list and a set of users from the second drop-down list or lookup field.
9. Select the sharing access setting for users.
Access Setting
Read Only
Read/Write
Description
Users can view, but not update, records.
Users can view and update records.
10. Click Save.
Sharing Rule Considerations
Sharing rules allow you to selectively grant data access to defined sets of users. Review the following notes before using sharing rules:
Granting Access
•
You can use sharing rules to grant wider access to data. You cannot restrict access below your organization-wide default levels.
•
If multiple sharing rules give a user different levels of access to a record, the user gets the most permissive access level.
•
Sharing rules automatically grant additional access to related records. For example, opportunity sharing rules give role or group members access to the account associated with the shared opportunity if they do not already have it. Likewise, contact and case sharing rules provide the role or group members with access to the associated account as well.
•
Users in the role hierarchy are automatically granted the same access that users below them in the hierarchy have from a sharing rule, provided that the object is a standard object or the Grant Access Using Hierarchies option is selected.
•
Regardless of sharing rules, users can, at a minimum, view the accounts in their territories.
Also, users can be granted access to view and edit the contacts, opportunities, and cases associated with their territories’ accounts.
Updating
•
Creating an owner-based sharing rule with the same source and target groups as an existing rule overwrites the existing rule.
•
Once a sharing rule has been saved, you can’t change the
Share with
field settings when you edit the sharing rule.
•
Sharing rules apply to all new and existing records that meet the definition of the source data set.
•
Sharing rules apply to both active and inactive users.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Account and contact sharing rules are available in:
Professional, Enterprise,
Performance, Unlimited, and Developer Editions
Account territory, case, lead, opportunity, order, and custom object sharing rules are available in: Enterprise,
Performance, Unlimited, and Developer Editions
Campaign sharing rules are available in Professional
Edition for an additional cost, and Enterprise,
Performance, Unlimited, and Developer Editions
Only custom object sharing rules are available in
Database.com
347
Set Up and Maintain Your Salesforce Organization User Sharing
•
When you change the access levels for a sharing rule, all existing records are automatically updated to reflect the new access levels.
•
When you delete a sharing rule, the sharing access created by that rule is automatically removed.
•
When you modify which users are in a group, role, or territory, the sharing rules are reevaluated to add or remove access as necessary.
•
When you transfer records from one user to another, the sharing rules are reevaluated to add or remove access to the transferred records as necessary.
•
Making changes to sharing rules may require changing a large number of records at once. To process these changes efficiently, your request may be queued and you may receive an email notification when the process has completed.
•
Lead sharing rules do not automatically grant access to lead information after leads are converted into account, contact, and opportunity records.
Portal Users
•
You can create rules to share records between most types of Customer Portal users and Salesforce users. Similarly, you can create sharing rules between Customer Portal users from different accounts as long as they have the Customer Portal Manager user license. However, you can’t include high-volume portal users in sharing rules because they don’t have roles and can’t be in public groups.
•
You can easily convert sharing rules that include Roles, Internal and Portal Subordinates to include Roles and Internal Subordinates instead by using the Convert Portal User Access wizard. Furthermore, you can use this wizard to convert any publicly accessible report, dashboard, and document folders to folders that are accessible by all users except for portal users.
Managed Package Fields
If a criteria-based sharing rule references a field from a licensed managed package whose license has expired,
(expired)
is appended to the label of the field. The field label is displayed in the field drop-down list on the rule’s definition page in Setup.
Criteria-based sharing rules that reference expired fields aren't recalculated, and new records aren't shared based on those rules.
However, the sharing of existing records prior to the package's expiration is preserved.
SEE ALSO:
Sharing Rules for Communities
User Sharing
User Sharing enables you to show or hide an internal or external user from another user in your organization.
Watch a demo: Who Sees Whom: User Sharing (Salesforce Classic)
For example, you might be a manufacturer who wants to include all dealers in your organization but keep them from seeing or interacting with each other. If so, set the organization-wide defaults for the user object to Private. Then, open up access to specified dealers with sharing rules or manual sharing.
With User Sharing, you can:
•
Assign the “View All Users” permission to users who need to see or interact with all users. This permission is automatically enabled for users who have the “Manage Users” permission.
•
Set the organization-wide default
for user records to Private or Public Read Only.
•
Create user sharing rules based on group membership or other criteria.
•
for user records to open up access to individual users or groups.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Manual sharing, portals, and communities available in: Salesforce Classic
Available in: Enterprise,
Performance, Unlimited, and Developer Editions
348
Set Up and Maintain Your Salesforce Organization User Sharing
•
Control the visibility of external users in customer or partner portals and communities.
SEE ALSO:
Restoring User Visibility Defaults
Controlling Who Community or Portal Users Can See
Understanding User Sharing
Set organization-wide defaults for internal and external user records. Then, extend access using sharing rules based on membership to public groups, roles, or territories, or use manual sharing to share individual user records with other users or groups.
EDITIONS
When you enable user sharing, users can see other users in search, list views, and so on only if they have Read access on those users.
Available in: Salesforce
Classic and Lightning
Experience
Review these considerations before you implement user sharing.
Manual sharing available in:
Salesforce Classic
“View All Users” permission
This permission can be assigned to users who need Read access to all users, regardless of the sharing settings. If you already have the “Manage Users” permission, you are automatically granted the “View All Users” permission.
Organization-wide defaults for user records
This setting defaults to Private for external users and Public Read Only for internal users. When the default access is set to Private, users can only read and edit their own user record. Users with subordinates in the role hierarchy maintain read access to the user records of those subordinates.
Available in: Professional,
Enterprise, Performance,
Unlimited, and Developer
Editions
User sharing rules
General sharing rule considerations
apply to user sharing rules. User sharing rules are based on membership to a public group, role, or territory. Each sharing rule shares members of a source group with those of the target group. You must create the appropriate public groups, roles, or territories before creating your sharing rules. Users inherit the same access as users below them in the role hierarchy.
Manual sharing for user records
Manual sharing can grant read or edit access on an individual user, but only if the access is greater than the default access for the target user. Users inherit the same access as users below them in the role hierarchy. Apex managed sharing is not supported.
User sharing for external users
Users with the “Manage External Users” permission have access to external user records for Partner Relationship Management,
Customer Service, and Customer Self-Service portal users, regardless of sharing rules or organization-wide default settings for User records. The “Manage External Users” permission does not grant access to guest or Chatter External users
User Sharing Compatibility
When the organization-wide default for the user object is set to Private, User Sharing does not fully support these features.
•
Chatter Messenger is not available for external users. It is available for internal users only when the organization-wide default for the user object is set to Public Read Only.
•
Customizable Forecasts—Users with the "View All Forecast" permission can see users to whom they don't have access.
•
Salesforce CRM Content—A user who can create libraries can see users they don't have access to when adding library members.
349
Set Up and Maintain Your Salesforce Organization User Sharing
•
Standard Report Types—Some reports based on standard report types expose data of users to whom a user doesn’t have access.
For more information, see Control Standard Report Visibility
.
SEE ALSO:
Set the Org-Wide Sharing Defaults for User Records
Set the org-wide sharing defaults for the user object before opening up access.
For user records, you can set the organization-wide sharing default to Private or Public Read Only.
The default must be set to Private if there is at least one user who shouldn’t see a record.
Let’s say that your organization has internal users (employees and sales agents) and external users
(customers/portal users) under different sales agents or portal accounts, with these requirements:
•
Employees can see everyone.
•
Sales agents can see employees, other agents, and their own customer user records only.
•
Customers can see other customers only if they are under the same agent or portal account.
To meet these requirements, set the default external access to Private, and extend access using sharing rules, manual sharing, or user permissions.
When the feature is first turned on, the default access setting is Private for external users. The default for internal users is Public Read Only. To change the organization-wide defaults for external access to the user object:
1. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing
Settings.
2. Click Edit in the Organization-Wide Defaults area.
3. Select the default internal and external access you want to use for user records.
The default external access must be more restrictive or equal to the default internal access.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, and Developer
Editions
USER PERMISSIONS
To set default sharing access:
•
Manage Sharing
4. Click Save.
Users have Read access to those below them in the role hierarchy and full access on their own user record.
SEE ALSO:
External Organization-Wide Defaults Overview
Controlling Who Community or Portal Users Can See
350
Set Up and Maintain Your Salesforce Organization User Sharing
Creating User Sharing Rules
Share members of a group to members of another group, or share users based on criteria.
User sharing rules can be based on membership to public groups, roles, or territories, or on other criteria such as Department and Title. By default, you can define up to 300 user sharing rules, including up to 50 criteria-based sharing rules. Contact Salesforce for information about increasing these limits.
User sharing rules based on membership enable user records belonging to members of one group to be shared with members of another group. Before you can create a membership-based user sharing rule, confirm that the appropriate groups have been created.
Users inherit the same access as users below them in the role hierarchy.
1. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing
Settings.
2. In the User Sharing Rules related list, click New.
3. Enter the Label Name and click the Rule Name field to auto-populate it.
4. Enter the Description. This field describes the sharing rule. It is optional and can contain up to
1000 characters.
5. Select a rule type.
6. Depending on the rule type you selected, do the following:
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, and Developer
Editions
USER PERMISSIONS
To create sharing rules:
•
Manage Sharing
a.
Based on group membership
—Users who are members of a group can be shared with members of another group.
In the
Users who are members of
line, select a category from the first drop-down list and a set of users from the second drop-down list (or lookup field, if your organization has over 200 groups, roles, or territories).
b.
Based on criteria
—Specify the Field, Operator, and Value criteria that records must match to be included in the sharing rule. The fields available depend on the object selected, and the value is always a literal number or string. Click Add Filter Logic... to change the default AND relationship between each filter.
7. In the
Share with
line, specify the group that should have access to the user records. Select a category from the first drop-down list and a set of users from the second drop-down list or lookup field.
8. Select the sharing access setting for users.
Access Setting
Read Only
Read/Write
Description
Users can view, but not update, records. They can see target users in list views, lookups, search, and interact with them on
Chatter.
Users can view and update records.
9. Click Save.
SEE ALSO:
351
Set Up and Maintain Your Salesforce Organization User Sharing
Editing User Sharing Rules
For user sharing rules based on membership to groups, roles, or territories, you can edit only the access settings. For user sharing rules based on other criteria, you can edit the criteria and access settings.
1. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing
Settings.
2. In the User Sharing Rules related list, click Edit next to the rule you want to change.
3. Change the Label and Rule Name if desired.
4. If you selected a rule that’s based on group membership, skip to the next step. If you selected a rule that's based on criteria, specify the criteria that records must match to be included in the sharing rule. The fields available depend on the object selected, and the value must be a literal number or string. Click Add Filter Logic... to change the default AND relationship between each filter.
5. Select the sharing access setting for users. The User Access level applies to users who are members of the groups being shared to.
Access Setting
Read Only
Read/Write
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, and Developer
Editions
USER PERMISSIONS
To edit sharing rules:
•
Manage Sharing
Description
Users can view, but not update, records.
Users can view and update records.
6. Click Save.
SEE ALSO:
Share User Records
Your administrator defines your organization’s sharing model and default access levels for user records. If the organization-wide default access is set to Private or Public Read Only, you can extend sharing privileges for your own user record. However, you can’t restrict access below your organization’s default access levels.
You can share external user records, such as external community users and customer portal or partner portal users. You can also share an internal user record with an external user. To view and manage sharing details, click Sharing on the user detail page. The Sharing Detail page lists the users, groups, roles, and territories that have sharing access to the user record. On this page, you can perform these tasks.
•
To show a filtered list of items, select a predefined list from the
View
drop-down list, or click
Create New View to define your own custom views. To edit or delete any view you created, select it from the
View
drop-down list and click Edit.
•
to the record for other users, groups, roles, or territories by clicking Add. This method of granting access is also known as manual sharing of your user records.
•
Edit or delete the manual share by clicking Edit or Del next to the rule.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, and Developer
Editions
USER PERMISSIONS
To view user records:
•
Read on user records
352
Set Up and Maintain Your Salesforce Organization User Sharing
An administrator can
disable or enable manual user record sharing
for all users.
SEE ALSO:
Differences Between User Sharing with Manual Sharing and Sharing Sets
Grant Access to User Records
You can manually grant access to your user records so that others can access them. Users inherit the same access permissions as users below them in the role hierarchy. Granting access to a user record makes the user’s detail page visible to others. It also makes the user visible in lookups, list views, search, and so on.
You can share your user record manually if others cannot access it through the organization-wide defaults, sharing rules, or role hierarchy. If you gain access through more than one method, the higher level of access is maintained. High-volume portal users can be shared with other users using manual shares, but not in sharing rules.
1. From Setup, enter
Users
in the
Quick Find
box, then select Users. Click the name of the user you want to share.
2. On the User Detail page, click Sharing.
3. Click Add.
4. From the drop-down list, select the group, user, role, or territory to share with.
5. Choose which users have access by adding them to the Share With list.
6. Select the access level for the record you are sharing.
Possible values are Read/Write or Read Only, depending on your organization-wide defaults for users. You can only grant a higher access level than your organization-wide default.
7. Click Save.
8. To change record access, on the user’s Sharing Detail page, click Edit or Del.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, and Developer
Editions
USER PERMISSIONS
To grant access to your own user record:
•
Read on the user with whom you’re sharing
Controlling Who Community or Portal Users Can See
If your organization has enabled a community and has portal licenses provisioned for it, User Sharing is enabled automatically. When User Sharing is on, you can choose which other users community users can see by default. If your organization has Customer or Partner Portals, you can choose a default for them as well. Users who can see one another can interact on all the communities or portals in your organization. For example, if you would like to have a more private community, you can deselect the Community User Visibility checkbox and use other sharing features like sharing rules, manual shares, or portal access.
For Communities and Portals, you can choose different defaults.
Communities
The initial default is to allow community users to be seen by all other internal and external users in communities they are a member of. You can change the default to allow external users in communities to be seen only by themselves and their superiors in the role hierarchy. The setting provides Read access only and applies to all communities in your organization.
EDITIONS
Available in: Salesforce
Classic
Available in: Enterprise,
Performance, Unlimited, and Developer Editions
USER PERMISSIONS
To set Community and Portal
User Visibility:
•
Manage Sharing
353
Set Up and Maintain Your Salesforce Organization User Sharing
Visibility to users as a result of the Community User Visibility preference is not inherited through the role hierarchy. If a manager in the role hierarchy is not a member of a community, but their subordinate is, the manager does not gain access to other members of the community.If Portal User Visibility is also selected, portal users can see other portal users from the same account as well.
Portals
The initial default is to allow portal users to be seen by other portal users within the same account. You can change the default to allow external users in portals to be seen by only themselves and their superiors in the role hierarchy. The setting provides Read access only and applies to all of the portals in your organization. If Community User Visibility is also selected, users from the same community can see each other as well.
Note: Partner portal users also have access to their channel manager.
1. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing Settings.
2. Click Edit in the Organization-Wide Defaults area.
3. Deselect the Portal User Visibility checkbox to allow users to be seen by only themselves and their superiors. Or select the checkbox to let portal users be seen by all other portal users within the same account.
4. For Community User Visibility, deselect the checkbox to allow users to be seen only by themselves and their superiors. Select the checkbox to allow community users to be seen by all other users in their communities.
Note:
This option only appears if Salesforce Communities is enabled.
5. Click Save.
Selecting either of these options is a quick way of overriding an organization-wide default setting of Private for external access to the
User object for Community or Portal users.
Once you have set these defaults, you can selectively expand access to users.
SEE ALSO:
Set the Org-Wide Sharing Defaults for User Records
Control Standard Report Visibility
354
Set Up and Maintain Your Salesforce Organization User Sharing
Control Standard Report Visibility
Show or hide standard reports that might expose data of users to whom a user doesn’t have access.
You can control whether users can see reports based on standard report types that can expose data of users to whom they don’t have access. When User Sharing is first enabled, all reports that contain data of users to whom a viewing user doesn’t have access are hidden.
1. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing
Settings.
2. Click Edit in the Organization-Wide Defaults area.
3. To allow users to view reports based on standard report types that can expose data of users to whom they don’t have access, select the Standard Report Visibility checkbox . Or, to hide these reports, deselect this checkbox.
4. Click Save.
If the organization-wide default for the user object is Private and the Standard Report Visibility checkbox is selected, a viewing user can see only the names of the users that they don’t have access to in the report. User details such as username and email are hidden. When you deselect the
Standard Report Visibility checkbox, users with the “View All Users” permission can still see all reports based on standard report types. All users can also see these reports if the organization-wide default for the user object is Public Read Only.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, and Developer
Editions
USER PERMISSIONS
To set standard report visibility:
•
Manage Sharing
Important: When Analytics sharing is in effect, all users in the organization get Viewer access to report and dashboard folders that are shared with them. Users who have been designated Manager or Editor on a folder, and users with additional administrative permissions, can have more access. Each user’s access to folders is based on the combination of folder access and user permissions.
To ensure that standard report folders are hidden as needed, remove sharing for all users from the folders. Then deselect the View
Dashboards in Public Folders and View Reports in Public Folders checkboxes for the users’ profiles.
SEE ALSO:
Report Types Support for User Sharing
Control Manual Sharing for User Records
Enable or prevent users from sharing their own user records with other users across the organization.
You can control whether the Sharing button is displayed on user detail pages. This button enables a user to grant others access to the user’s own user record. You can hide or display this button for all users by following these steps.
1. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing
Settings.
2. Click Edit in the Organization-Wide Defaults area.
3. Select the Manual User Record Sharing checkbox to display the Sharing button on user detail pages, which enables users to share their records with others. Or deselect the checkbox to hide the button, which prevents users from sharing their user records with others.
4. Click Save.
EDITIONS
Available in: Salesforce
Classic
Available in: Professional,
Enterprise, Performance,
Unlimited, and Developer
Editions
USER PERMISSIONS
To enable or disable manual user record sharing:
•
Manage Users
355
Set Up and Maintain Your Salesforce Organization User Sharing
When the organization-wide default for users is set to Public Read Only, users get read access to all other user records, can see those users in search and list views, and can interact with those users on Chatter and Communities.
Example: For example, a partner user wants to collaborate with the sales representative in Communities. If you have disabled the
Community User Visibility
checkbox in the Sharing Settings page, community users can only be seen by themselves and their superiors in the role hierarchy. You can use manual sharing to grant the partner user read access to the sales representative by using the Sharing button on the sales representative’s user detail page. This access enables both parties to interact and collaborate in Communities.
SEE ALSO:
Controlling Who Community or Portal Users Can See
Restoring User Visibility Defaults
User Sharing enables you to control who sees who in the organization. You can restore your defaults if you have previously used User Sharing.
To restore user visibility defaults:
1. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing
Settings.
2. Set the organization-wide defaults to Public Read Only for internal access and Private for external access.
3. Enable portal account user access.
On the Sharings Settings page, select the Portal User Visibility checkbox. This option enables customer portal users to see other users under the same portal account. Additionally, partner portal users can see the portal account owner. If Community User Visibility is also selected, users from the same community can see each other as well.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Portals and communities available in: Salesforce
Classic
Available in: Enterprise,
Performance, Unlimited, and Developer Editions
USER PERMISSIONS
4. Enable network member access.
On the Sharing Settings page, select the Community User Visibility checkbox. This option enables community members to be seen by all other users in their communities. If Portal User
Visibility is also selected, portal users can see other portal users from the same account as well.
5. Remove user sharing rules.
On the Sharing Settings page, click Del next to all available user sharing rules.
To restore user visibility defaults:
•
Manage Sharing
6. Remove HVPU access to user records.
On the Customer Portal Setup page, click Del next to all available sharing sets for HVPUs.
After user visibility is restored to the defaults, all internal users are visible to each other, portal users under the same portal account are visible to each other, and community members in the same community are visible to each other.
SEE ALSO:
Controlling Who Community or Portal Users Can See
356
Set Up and Maintain Your Salesforce Organization User Sharing
Report Types Support for User Sharing
Reports based on standard report types might expose data of users to whom a user doesn’t have access.
The following report types might expose data of users to whom a viewing user doesn’t have access.
EDITIONS
•
Accounts
•
Account Owners
•
Accounts with Assets
•
Accounts with Custom Objects
•
Accounts with Partners
•
API Usage
•
Campaigns with Opportunities
•
Customizable Forecasting: Forecast History
•
Customizable Forecasting: Opportunity Forecasts
•
Custom Object Opportunity with Quotes Report
•
Events with Invitees
•
Opportunity
•
Opportunity Field History
•
Opportunity History
•
Opportunity Trends
•
Opportunities and Connections
•
Opportunities with Competitors
•
Opportunities with Contact Roles
•
Opportunities with Contact Roles and Products
•
Opportunities with Custom Objects
•
Opportunities with Partners
•
Opportunities with Products
•
Opportunities with Products and Schedules
•
Opportunities with Quotes and Quote Documents
•
Opportunities with Quotes and Quote Line Items
•
Opportunities with Sales Teams
•
Opportunities with Sales Teams and Products
•
Split Opportunities
•
Split Opportunities with Products
•
Split Opportunities with Products and Schedules
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, and Developer
Editions
By default, these reports are accessible only to users who have the appropriate access. However, you can change the setting such that users without the appropriate access to the relevant users can see those reports.
357
Set Up and Maintain Your Salesforce Organization User Sharing
Additionally, some reports may display a user’s role. When a user can see a record but does not have access to the record owner, the user can see the owner’s role on those reports.
SEE ALSO:
Control Standard Report Visibility
Differences Between User Sharing with Manual Sharing and Sharing Sets
Manual sharing and sharing sets provide access to different groups of users.
You can control who sees whom in the organization, including internal and external users, if your organization has User Sharing enabled. Manual sharing and sharing sets provide additional access beyond the organization-wide defaults and sharing rules. External users, such as high-volume portal or community users (HVPU), don’t have roles and can’t be used in sharing rules.
EDITIONS
Available in: Salesforce
Classic
Example:
Grant internal and non-HVPU users access to a user by creating a manual share using the Sharing button on the user detail page of that user. Grant HVPUs access to other users by creating a sharing set for your portals or communities.
The following table shows when to use manual sharing and sharing sets.
Available in: Enterprise,
Performance, Unlimited, and Developer Editions
Internal
Non-HVPU
HVPU
Internal
Manual Sharing
Manual Sharing
Manual Sharing
Users Getting Access
Non-HVPU
1
HVPU
2
Manual Sharing
Manual Sharing
Manual Sharing
Sharing Set
Sharing Set
Sharing Set
1
Non-HVPU refers to an external user who is not using an HVPU profile.
2
HVPU refers to an external user that has one of these profiles:
•
Authenticated Website
•
Customer Community User
•
Customer Community Login User
•
High Volume Customer Portal
•
High Volume Portal
•
Overage Authenticated Website User
•
Overage High Volume Customer Portal User
SEE ALSO:
358
Set Up and Maintain Your Salesforce Organization Sharing Considerations
Sharing Considerations
Learn how sharing models give users access to records they don’t own.
The sharing model is a complex relationship between role hierarchies, user permissions, sharing rules, and exceptions for certain situations.
Review the following notes before setting your sharing model:
Exceptions to Role Hierarchy-based Sharing
Users can always view and edit all data owned by or shared with users below them in the role hierarchy. Exceptions to this include:
•
An option on your organization-wide default allows you to ignore the hierarchies when determining access to data.
•
Contacts that are not linked to an account are always private. Only the owner of the contact and administrators can view it. Contact sharing rules do not apply to private contacts.
•
Notes and attachments marked as private via the
Private
checkbox are accessible only to the person who attached them and administrators.
•
Events marked as private via the
Private
checkbox are accessible only by the event owner. Other users cannot see the event details when viewing the event owner’s calendar. However, users with the “View All Data” or “Modify All Data” permission can see private event details in reports and searches, or when viewing other users’ calendars.
•
Users above a record owner in the role hierarchy can only view or edit the record owner’s records if they have the “Read” or “Edit” object permission for the type of record
•
Visibility to users as a result of the Community User Visibility preference is not inherited through the role hierarchy. If a manager in the role hierarchy is not a member of a community, but their subordinate is, the manager does not gain access to other members of the community. This only applies if Salesforce Communities is enabled in your organization.
Deleting Records
•
The ability to delete individual records is controlled by administrators, the record owner, users in a role hierarchy above the record owner, and any user that has been granted “Full Access.”
•
If the sharing model is set to Public Read/Write/Transfer for cases or leads or Public Full Access for campaigns, any user can delete those types of records.
Adding Related Items to a Record
•
You must have “Read/Write” access to a record to be able to add notes or attachments to the record.
•
You must have at least “Read” access to a record to be able to add activities or other associated records to it.
Adding or Removing Sharing Access Manually
•
The ability to manually extend the sharing access of individual records is controlled by administrators, the record owner, users in a role hierarchy above the record owner, and any user that has been granted “Full Access.”
•
Changing your sharing model deletes any manual shares your users have created.
User Permissions and Object-Level Permissions
While your sharing model controls visibility to records, user permissions and object-level permissions control what users can do to those records.
359
Set Up and Maintain Your Salesforce Organization Sharing Considerations
•
Regardless of the sharing settings, users must have the appropriate object-level permissions. For example, if you share an account, those users can only see the account if they have the “Read” permission on accounts. Likewise, users who have the “Edit” permission on contacts may still not be able to edit contacts they do not own if they are working in a Private sharing model.
•
Administrators, and users with the “View All Data” or “Modify All Data” permissions, have access to view or edit all data.
Account Sharing
•
To restrict users’ access to records they do not own that are associated with accounts they do own, set the appropriate access level on the role. For example, you can restrict a user’s access to opportunities they do not own yet are associated with accounts they do own using the
Opportunity Access
option.
•
Regardless of the organization-wide defaults, users can, at a minimum, view the accounts in their territories. Also, users can be granted access to view and edit the contacts, opportunities, and cases associated with their territories’ accounts.
Apex Sharing
The organization-wide default settings can’t be changed from private to public for a custom object if Apex code uses the sharing entries associated with that object. For example, if Apex code retrieves the users and groups who have sharing access on a custom object
Invoice__c (represented as
Invoice__share
in the code), you can’t change the object’s organization-wide sharing setting from private to public.
Campaign Sharing
•
In Professional, Enterprise, Unlimited, Performance, and Developer Editions, designate all users as Marketing Users when enabling campaign sharing. This simplifies administration and troubleshooting because access can be controlled using sharing and profiles.
•
To segment visibility between business units while maintaining existing behavior within a business unit:
1. Set the campaign organization-wide default to Private.
2. Create a sharing rule to grant marketing users Public Full Access to all campaigns owned by users within their business unit.
3. Create a sharing rule to grant all non-marketing users in a business unit Read Only access to all campaigns owned by users in their business unit.
•
When a single user, such as a regional marketing manager, owns multiple campaigns and needs to segment visibility between business units, share campaigns individually instead of using sharing rules. Sharing rules apply to all campaigns owned by a user and do not allow segmenting visibility.
•
Create all campaign sharing rules prior to changing your organization-wide default to reduce the affect the change has on your users.
•
To share all campaigns in your organization with a group of users or a specific role, create a sharing rule that applies to campaigns owned by members of the “Entire Organization” public group.
•
Minimize the number of sharing rules you need to create by using the “Roles and Subordinates” option instead of choosing a specific role.
•
If campaign hierarchy statistics are added to the page layout, a user can see aggregate data for a parent campaign and all the campaigns below it in the hierarchy regardless of whether that user has sharing rights to a particular campaign within the hierarchy.
Therefore, consider your organization’s campaign sharing settings when enabling campaign hierarchy statistics. If you do not want users to see aggregate hierarchy data, remove any or all of the campaign hierarchy statistics fields from the Campaign Hierarchy related list. These fields will still be available for reporting purposes.
•
If the sharing model is set to Public Full Access for campaigns, any user can delete those types of records.
360
Set Up and Maintain Your Salesforce Organization Who Has Access to Account Records?
Campaign Member Sharing
Campaign member sharing is controlled by campaign sharing rules. Users that can see a campaign can also see associated campaign members.
Contact Sharing
The organization-wide sharing default for contacts is not available to organizations that have person accounts enabled.
Price Book Sharing
•
Sharing on price books controls whether users can add the price book and its products to opportunities.
•
User permissions control whether users can view, create, edit, and delete price books.
SEE ALSO:
Who Has Access to Account Records?
A user may have access to an account from:
•
Record Ownership
•
Implicit access from an associated child record such as a case, contact, or opportunity
•
Organization-wide sharing defaults
•
Role hierarchy
•
Sharing rules
•
Manual sharing
•
Account team or territory
To find out why a user have access to the record, click the Sharing button on the account detail page to see a list of users who have access and for which reasons. Click Expand List to see all users who have access.
The following users don’t show up in the list even if they may have access:
•
All users, if the organization-wide defaults are set to Public Read Only or Public Read/Write
•
High-volume portal users
Note: If the Sharing button does not appear, the organization-wide sharing defaults may have been set to Controlled by Parent or Public Read. Otherwise, only the record owner, an administrator, or a user above the owner in the role hierarchy can see the
Sharing Detail page.
Access Type
Record owner
Implicit access
Table 2: Troubleshooting guideline for user access to a record
Description
The record owner always gets access to his or her own record.
Corresponds to the “Associated record owner or sharing” entry in the Reason column of the Sharing Detail page. The user may have access to a child record of an account (opportunity, case, or contact), which grants
361
Set Up and Maintain Your Salesforce Organization Viewing Sharing Overrides
Access Type
Organization-wide sharing default
Role hierarchy
Sharing rules
Manual shares
Account Teams and
Territory
Description
them Read access on that account. You cannot overwrite this access. For example, if the user has access to a case record, he or she has implicit Read access to the parent account record.
Check if the defaults for the account object are set to Private. If it is, the user may have gained access via other methods listed here. It must be set to Private if at least one of your users should not see a record.
The user may have inherited Read access from a subordinate in the role hierarchy. You can’t override this behavior for non-custom objects. If the user who has access is on a different branch of the hierarchy from the account owner, check the sharing rules, account teams, and account territory.
The user may have gotten access because he or she has been included in a relevant sharing rule. If the sharing rule uses public groups (or other categories such as roles) to grant access, check your public groups to see if the user has been included in the group.
The user may have gotten access through the Sharing button of the record. Only the record owner, an administrator, or a user above the owner in the role hierarchy can create or remove a manual share on the record.
The user may have been added to an Account Team by the account owner, an administrator, a user above the owner in the role hierarchy, or an account team member. If your organization uses territory management, check if the user who has access is higher in the territory hierarchy than the account owner. Managers gain the same access as their subordinates. Additionally, if the user is a member of Group A, which is a member of
Group B, he or she gets access to all accounts shared to Group B, at the same level of access as members of
Group B.
SEE ALSO:
Resolving Insufficient Privileges Errors
Viewing Sharing Overrides
When you select an object in the Sharing Settings page, the page includes a Sharing Overrides related list, which shows any profiles that ignore sharing settings for that object.
To view the Sharing Overrides list, from Setup, enter
Sharing Settings
in the
Quick
Find
box, then select Sharing Settings. Next, select an object from the Manage Sharing Settings
For list.
For each profile, the list specifies the permissions that allow it to override sharing settings. The “View
All Data” and “Modify All Data” permissions override sharing settings for all objects in the organization, while the object permissions “View All” and “Modify All” override sharing settings for the named object.
Note: The Sharing Overrides list doesn't show permissions granted through permission sets, which may also override sharing settings for an object.
To override sharing settings for specific objects, you can create or edit permission sets or profiles and enable the “View All” and “Modify All” object permissions. These permissions provide access
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
USER PERMISSIONS
To view sharing overrides:
•
View Setup and
Configuration
362
Set Up and Maintain Your Salesforce Organization Recalculate Sharing Rules to all records associated with an object across the organization, regardless of the sharing settings. Before setting these permissions, compare the different ways to control data access.
SEE ALSO:
Recalculate Sharing Rules
When you make changes to groups, roles, and territories, sharing rules are reevaluated to add or remove access as necessary.
Changes could include adding or removing individual users from a group, role, or territory, changing which role a particular role reports to, changing which territory a particular territory is subordinate to, or adding or removing a group from within another group.
Note:
Use the Recalculate buttons on the Sharing Rules related lists only if sharing rule updates have failed or are not working as expected.
To manually recalculate an object’s sharing rules:
1. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing
Settings.
2. In the Sharing Rules related list for the object you want, click Recalculate.
3. If you want to monitor the progress of a recalculation, from Setup, enter
Background Jobs
in the
Quick Find
box, then select Background Jobs.
Note: The Recalculate button is disabled when group membership or sharing rule calculations are deferred. Sharing rules for related objects are automatically recalculated. For example, account sharing rules are recalculated when opportunity sharing rules are recalculated since the opportunity records are in a master-detail relationship on account records.
When sharing is recalculated, Salesforce also runs all Apex sharing recalculations. During sharing rule recalculation, related object sharing rules are calculated as well. You receive an email that notifies you when the recalculation is completed. For example, when recalculating sharing rule for opportunities, account sharing rules are recalculated as well since opportunity is a detail of an account object.
Automatic sharing rule calculation is enabled by default. You can defer sharing rule calculation by suspending and resuming at your discretion.
SEE ALSO:
Asynchronous Parallel Recalculation of Sharing Rules
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Account and contact sharing rules are available in:
Professional, Enterprise,
Performance, Unlimited, and Developer Editions
Account territory, case, lead, opportunity, order sharing rules, and custom object sharing rules are available in: Enterprise, Performance,
Unlimited, and Developer
Editions
Campaign sharing rules are available in Professional
Edition for an additional cost, and Enterprise,
Performance, Unlimited, and Developer Editions
USER PERMISSIONS
To recalculate sharing rules:
•
Manage Sharing
363
Set Up and Maintain Your Salesforce Organization Recalculate Sharing Rules
Asynchronous Parallel Recalculation of Org-Wide Defaults (Pilot)
When you update an org-wide default, recalculation is now processed asynchronously and in parallel. This change provides optimal efficiency of server resources and guards against site operations such as patches and server restarts. Your org must have object-specific share locks enabled, which is available to all new and existing orgs in Winter ’17.
Note: We provide Asynchronous Parallel Recalculation of Org-Wide Defaults to selected customers through a pilot program that requires agreement to specific terms and conditions.
To be nominated to participate in the program, contact Salesforce. Pilot programs are subject to change, and we can’t guarantee acceptance. The Asynchronous Parallel Recalculation of
Org-Wide Defaults isn’t generally available unless or until Salesforce announces its general availability in documentation or in press releases or public statements. We can’t guarantee general availability within any particular time frame or at all. Make your purchase decisions only based on generally available products and features. You can provide feedback and suggestions for the Asynchronous Parallel Recalculation of Org-Wide Defaults in the
IdeaExchange .
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, and Developer
Editions
You receive an email notification when the recalculation is completed. Consider the following guidelines when updating your org-wide defaults.
•
While recalculation is in progress, you can’t create, update, or delete sharing rules and org-wide defaults for that object. However, you can make changes to the org-wide default and sharing rules for another object.
•
Updating the org-wide default on an account or its children—cases, contacts, and opportunities—disables further org-wide default and sharing rule updates on them. For example, when you update the opportunity org-wide default and recalculation is in progress, you can’t update the org-wide default or sharing rules for accounts, contacts, opportunities, and cases.
SEE ALSO:
Asynchronous Parallel Recalculation of Sharing Rules
Asynchronous Parallel Recalculation of Sharing Rules
Speed up sharing rule recalculation by running it asynchronously and in parallel.
When you create, update, or delete sharing rules, the resulting recalculation is now processed asynchronously and in parallel. The recalculation is run in parallel and asynchronously in the background, which speeds up the process and provides better resilience to site operations such as patches and server restarts. You’ll receive an email notification upon completion. Before the recalculation is completed, you can’t run other sharing operations such as creating a sharing rule or updating the organization-wide defaults.
If the number of impacted records from an owner-based sharing rule insert or update is less than
25,000, recalculation runs synchronously and you won’t receive an email notification when it’s completed. Owner-based sharing rule inserts and updates impacting less than 25,000 records are not available on the Background Jobs page.
Parallel sharing rule recalculation is also run in these cases.
•
Click the Recalculate button for the sharing rules on the Sharing Settings page
•
Recalculate your sharing rules on the Defer sharing page
EDITIONS
Available in: both Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, and Developer
Editions
364
Set Up and Maintain Your Salesforce Organization Recalculate Sharing Rules
You can monitor the progress of your parallel recalculation on the Background Jobs page or view your recent sharing operations on the
View Setup Audit Trail page.
Recalculation of sharing rules maintains implicit sharing between accounts and child records. In the Background Jobs page, these processes corresponds to these job sub types:, Account — Extra Parent Access Removal and Account — Parent Access Grant.
Additionally, deleting a sharing rule corresponds to the job sub type Object — Access Cleanup, denoting that irrelevant share rows are removed.
Note:
For an in-depth look at record access, see
Designing Record Access for Enterprise Scale
.
SEE ALSO:
Defer Sharing Calculations
Performing a large number of configuration changes can lead to very long sharing rule evaluations or timeouts. To avoid these issues, an administrator can suspend these calculations and resume calculations during an organization's maintenance period.
Note: The defer sharing calculation feature isn't enabled by default. To enable it for your organization, contact Salesforce.
Deferring sharing calculation is ideal if you make a large number of changes to roles, territories, groups, users, portal account ownership, or public groups participating in sharing rules, and want to suspend the automatic sharing calculation to a later time.
Group membership and sharing rule calculation are enabled by default.
If
Group membership and sharing rule calculation are enabled
Group membership calculation is enabled and sharing rule calculation is suspended
Group membership calculation is suspended and sharing rule calculation is enabled
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Enterprise,
Performance, Unlimited, and Developer Editions
You can
•
Suspend, update, and resume group membership calculation.
This suspends sharing rule calculation and requires a full recalculation of sharing rules.
•
Suspend, update, and resume sharing rule calculation.
Suspend, update, and, resume group membership calculation.
Suspend, update, resume, and recalculate sharing rule calculation.
To suspend or resume group membership calculation, see
Manage Group Membership Calculations .
To suspend, resume, or recalculate sharing rule calculation, see
Deferring Sharing Rule Calculations
.
SEE ALSO:
365
Set Up and Maintain Your Salesforce Organization Recalculate Sharing Rules
Manage Group Membership Calculations
If you are making changes to groups that affect a lot of records, you may want to suspend automatic group membership calculation and resume at a later time. Note that you might experience sharing inconsistencies in your records if you don’t resume calculation.
When you make changes to roles, territories, groups, or users, or change ownership of portal accounts, group membership is automatically recalculated to add or remove access as necessary.
Changes can include adding or removing a user from a group or changing a role to allow access to different sets of reports.
To suspend or resume group membership calculation:
1. From Setup, enter
Defer Sharing Calculations
in the
Quick Find
box, then select Defer Sharing Calculations.
2. In the Group Membership Calculations related list, click Suspend.
Note:
If sharing rule calculations are enabled, suspending group membership calculations also suspends sharing rule calculations. Resuming group membership calculations also requires full sharing rule recalculation.
3. Make your changes to roles, territories, groups, users, or portal account ownership.
4. To enable group membership calculation, click Resume.
SEE ALSO:
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Enterprise,
Performance, Unlimited, and Developer Editions
USER PERMISSIONS
To defer (suspend and resume) sharing calculations:
•
Manage Users
AND
Manage Sharing
Calculation Deferral
366
Set Up and Maintain Your Salesforce Organization Recalculate Sharing Rules
Deferring Sharing Rule Calculations
Note: The defer sharing calculation feature isn't enabled by default. To enable it for your organization, contact Salesforce.
To suspend, resume, or recalculate sharing rule calculation:
1. From Setup, enter
Defer Sharing Calculations
in the
Quick Find
box, then select Defer Sharing Calculations.
2. In the Sharing Rule Calculations related list, click Suspend.
3. Make changes to sharing rules, roles, territories, or public groups participating in sharing rules.
Note: Any changes to sharing rules require a full recalculation.
To enable sharing rule calculation, click Resume.
4. To manually recalculate sharing rules, click Recalculate.
Consider deferring your sharing calculations before performing massive updates to sharing rules.
When sharing is recalculated, Salesforce also runs all Apex sharing recalculations.
SEE ALSO:
Manage Group Membership Calculations
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Account and contact sharing rules are available in:
Professional, Enterprise,
Performance, Unlimited, and Developer Editions
Account territory, case, lead, and opportunity, sharing rules are available in:
Enterprise, Performance,
Unlimited, and Developer
Editions
Campaign sharing rules are available in Professional
Edition for an additional cost, and Enterprise,
Performance, Unlimited, and Developer Editions
Custom object sharing rules are available in: Enterprise,
Performance, Unlimited,
Developer, and
Database.com Editions.
USER PERMISSIONS
To defer (suspend and resume) and recalculate sharing rules:
•
Manage Users
AND
Manage Sharing
Calculation Deferral
367
Set Up and Maintain Your Salesforce Organization Recalculate Sharing Rules
Object-Specific Share Locks
When you create, edit, or delete a sharing rule, recalculation runs to update record access in your org. This operation can take some time if you have many users and records. Object-specific share locks feature enables you to make changes to a sharing rule for other objects simultaneously, depending on the objects affected by the sharing rules, sharing rule type, and target groups or roles of the affected users.
Without object-specific share locks, you can’t submit simultaneous sharing changes until recalculation across all objects is complete. If you are enabling object-specific share locks, consider the following changes in your org.
Criteria-based and ownership-based sharing rules
Recalculation is run if a sharing rule has changed or when you click the Recalculate button on the Sharing Settings page. Clicking this button locks sharing rules for that object (1), but you can still make changes to sharing rules for another object.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, and Developer
Editions
Note: Use the Recalculate buttons on the Sharing Rules related lists only if sharing rule updates have failed or are not working as expected.
When recalculation for an ownership-based sharing rule is in progress, you can’t create, edit, or delete ownership-based sharing rules for that object targeting the same group of users. For example, let’s say you’re creating an ownership-based lead sharing rule targeting the All Internal Users group. While recalculation is in progress, you can create another ownership-based sharing rule for leads targeting any other public group except the All Internal Users group. You can create, update, or delete ownership-based sharing rules for leads targeting all internal users only after the recalculation finishes. You receive an email notification when the recalculation is complete.
When recalculation for a criteria-based sharing rule is in progress, you can’t edit or delete that rule. But you can create, edit, or delete any other criteria-based or ownership-based sharing rule for that object regardless of the target group of users.
Note: You can’t modify the org-wide defaults when a sharing rule recalculation for any object is in progress. Similarly, you can’t modify sharing rules when recalculation for an org-wide default update is in progress.
Account, cases, contacts, and opportunities
Sharing rules can affect accounts and the associated account children—cases, contacts, and opportunities—so they are locked together to ensure that recalculation runs properly. For example, creating or editing an account sharing rule prevents you from creating or editing a case, contact, or opportunity sharing rule. Similarly, creating or editing an opportunity sharing rule prevents you from creating or editing a case, contact, or account sharing rule before recalculation is complete. Locks are not shared across objects, except across accounts and associated account children.
368
Set Up and Maintain Your Salesforce Organization Recalculate Sharing Rules
Note: Clicking the Recalculate button for any of these four objects’ sharing rules prevents anyone from making changes to sharing rules for those objects until recalculation finishes.
In the following example, an ownership-based account sharing rule has been deleted and recalculation is in progress. Although you can’t create, edit, or delete another ownership-based sharing rule for any of these objects, you can make changes to a criteria-based sharing rule (2) for those objects.
SEE ALSO:
369
Set Up and Maintain Your Salesforce Organization Recalculate Sharing Rules
Built-in Sharing Behavior
Salesforce provides implicit sharing between accounts and child records (opportunities, cases, and contacts), and for various groups of portal users.
EDITIONS
Sharing between accounts and child records
Available in: Salesforce
Classic
•
Access to a parent account—If you have access to an account’s child record, you have implicit Read Only access to that account.
•
Access to child records—If you have access to a parent account, you have access to the associated child records. The account owner's role determines the level of access to child records.
Sharing for accounts and contacts is available in:
Professional, Enterprise,
Performance, Unlimited, and Developer Editions
Sharing behavior for portal users
•
Account and case access—An account’s portal user has Read Only access to the parent account and to all of the account’s contacts.
•
Management access to data owned by Service Cloud portal users—Since Service
Cloud portal users don't have roles, portal account owners can't access their data via the role hierarchy. To grant them access to this data, you can add account owners to the portal’s share group where the Service Cloud portal users are working. This step provides access to all data owned by Service Cloud portal users in that portal.
•
Case access—If a portal user is a contact on a case, then the user has Read Only access on the case.
Sharing for cases and opportunities is available in
Enterprise, Performance,
Unlimited, and Developer
Editions
Group membership operations and sharing recalculation
Simple operations such as changing a user’s role, moving a role to another branch in the hierarchy, or changing a portal account’s owner can trigger a recalculation of sharing rules. Salesforce must check access to user’s data for people who are above the user’s new or old role in the hierarchy, and either add or remove shares to any affected records.
Note: These sharing behaviors simplify administration for data access but can make mass inserts and mass updates slow. For best practices on designing record access in a large organization, see
Designing Record Access for Enterprise Scale
.
SEE ALSO:
Resolving Insufficient Privileges Errors
If you can’t access a record or perform a task, like run a report, you most likely don’t have the required permission or sharing setting.
You see the Insufficient Privileges error, if you don’t have the right access on different levels. For example, your profile prevents you from accessing the account object, or your role prevents you from accessing a case record. You also see an Insufficient Privileges error when you click a link to a record or a Visualforce page tab to which you don’t have access.
EDITIONS
Available in: Salesforce
Classic
Available in: All Editions
Record owners can resolve most cases by using the Sharing button on the record detail page, which enables them to share the record to another user. Administrators can also resolve this issue using the API, such as querying the
UserRecordAccess object to check a user’s access to a set of records. For more information, see the
SOAP API Developer's Guide
.
If these tools can’t help you resolve the issue, an administrator can try to diagnose it with this troubleshooting flow.
•
Resolve object-level access errors by reviewing the user profiles and permission sets.
•
•
Resolve process-level errors by reviewing validation rules and Apex triggers.
370
Set Up and Maintain Your Salesforce Organization Recalculate Sharing Rules
It’s a good idea for an administrator to log in to the application using your login to help you resolve an issue. You can grant administrators access for a specified duration.
Note: Watch this video series to understand how to grant users the access they need. Who Sees What
Resolve Permission and Object-Level Access Errors
Missing or incorrect object and user permissions can cause Insufficient Privileges errors. You can troubleshoot this type of error by checking profile and permission sets.
Generally, the best method for investigating object and permission access issues is through the
API. However, you can use the following steps to investigate via point-and-click tools.
EDITIONS
Available in: Salesforce
Classic
1. Verify the object permissions in the user’s profile.
Object permissions, configured on profiles and permission sets, determine which objects a user can read, create, edit, or delete.
Available in: All Editions
USER PERMISSIONS
a. On the user detail page, click the user’s profile.
b. On the profile overview page, go to Object Settings or Object Permissions.
Note the permissions for the object. If the user is trying to view an account, check that the
“Read” permission for the account and contact objects on the user profile is enabled.
If the user is trying to run a report, check that the user has “Read” permission on an object that the report references.
2. Verify the user permissions in one of the following ways, depending on your profile user interface.
To view profiles and permission sets:
•
View Setup and
Configuration
To edit object permissions:
•
Manage Profiles and
Permission Sets
AND
Customize Application
•
From the enhanced profile user interface, review the permissions in the App Permissions and System Permissions sections.
•
From the original profile user interface, review the permissions under Administrative
Permissions and General User Permissions.
Note the relevant user permissions. For example, if the user is trying to send an email to a lead, check that the “Send Email” permission is enabled.
3. Verify the permissions in the user’s permission sets.
a. On the user detail page, scroll to the Permission Set Assignments related list and click each permission set.
b. On the permission set overview page, click Object Settings and review the assigned object permissions.
c. Review the user permissions in the App Permissions and System Permissions sections.
d. Repeat these steps for each permission set assigned to the user.
4. If needed, assign the necessary permission using a permission set or by updating the profile. Permission sets provide access on an individual basis. Assign permissions on the user profile only if all users of this profile require access. Be sure you're aware of your organization's security policy and act accordingly.
SEE ALSO:
Resolving Insufficient Privileges Errors
371
Set Up and Maintain Your Salesforce Organization Recalculate Sharing Rules
Resolve Record-Level Access Errors
Your sharing settings, such as roles or sharing rules, can cause Insufficient Privileges errors.
EDITIONS
To verify if the error is at record-level, follow these steps. You can also use the API to query a user’s access to a set of records or use the Sharing button on the record detail page.
1. If your organization uses roles, check the user’s role in relation to the record owner.
For example, users can delete records only if they are the record owner, higher in the role hierarchy than the record owner, or the administrator. Similarly, users always have read access to records whose owners are below them in the role hierarchy, unless Grant Access Using
Hierarchies is deselected (custom objects only).
Available in: Salesforce
Classic
Available in: All Editions
USER PERMISSIONS
a. From Setup, enter
Users
in the
Quick Find
box, then select Users.
Verify the role of the user and the role of the user who owns the record. A user can’t delete or merge accounts owned by someone in an unrelated role hierarchy, even if the user has the appropriate permissions on the objects.
To create or edit sharing rules:
•
Manage Sharing
To set up teams:
•
Customize Application
To manage territories:
•
Manage Territories
2. Review your sharing rules.
Check that the user is included in the sharing rules.
a. From Setup, enter
Sharing Settings
in the
Quick Find
box, then select Sharing
Settings.
b. Check the public group (or other categories such as roles or queues) and verify that the user is included in that sharing rule.
3. Verify your sales teams.
If your organization uses teams for accounts, opportunities, or cases, check that you didn’t miss the user when you set up the teams.
Review your teams to determine if the user is supposed to have access through a team.
a. From Setup, enter the team that you want to check, such as
Account Teams
, in the
Quick Find
box, then select the team.
Add the user to the team, if appropriate.
4. Review your manual shares.
If the user had access via a manual share but then lost this access because
•
The record owner changed, causing the manual share to be automatically dropped
•
The record owner, an administrator, or a user above the owner in the role hierarchy removed the manual share using the Sharing button on the record detail page
a. On the record detail page, click Sharing.
The Sharing Detail page shows the users, groups, roles, and territories that have access to the record.
b. If the user must gain access via a manual share, create a manual share by clicking Add.
5. Review your territories.
If your organization is using territories, check that
•
The user included in the territories
372
Set Up and Maintain Your Salesforce Organization Recalculate Sharing Rules
•
The record is under the correct territory where the user is a member.
SEE ALSO:
Resolving Insufficient Privileges Errors
Resolve Process-Level Access Errors
Validation rules can cause Insufficient Privileges errors.
To resolve Insufficient Privileges errors, you typically determine if misconfigured permission sets, profiles, or sharing settings are causing the errors. Another option is to review your organization’s validation rules.
1. Review your validation rules.
A validation rule can prevent the user from completing a task, such as transferring a case record after it’s closed.
2. From your object management settings, find the object that you want to check, and then scroll down to Validation Rules.
3. Verify that none of the validation rules are causing the error or fix the validation rule.
SEE ALSO:
Resolving Insufficient Privileges Errors
EDITIONS
Available in: both Salesforce
Classic and Lightning
Experience
Available in: All Editions
USER PERMISSIONS
To view and change validation rules:
•
View Setup and
Configuration
AND
Customize Application
To view and define Apex triggers:
•
Author Apex
373
Set Up and Maintain Your Salesforce Organization Recalculate Sharing Rules
Managing Folders
A folder is a place where you can store reports, dashboards, documents, or email templates. Folders can be public, hidden, or shared, and can be set to read-only or read/write. You control who has access to its contents based on roles, permissions, public groups, and license types. You can make a folder available to your entire organization, or make it private so that only the owner has access.
•
To access document folders, click the Documents tab.
•
To access email template folders, from Setup, enter
Email Templates
in the
Quick
Find
box, then select Email Templates.
To create a folder, click Create New Folder.
To edit a folder, click Edit next to the folder name. Alternatively, select a folder name from the Folder drop-down list and click Edit.
Note: You can modify the contents of a folder only if the folder access level is set to read/write.
Only users with the “Manage Public Documents” or “Manage Public Templates” permission can delete or change a read-only folder. Regardless of permissions or folder settings, users can’t edit unfiled or personal folders. Users with the “Manage Reports in Public Folders” permission can edit all reports in public folders but not reports in other users’ personal folders.
SEE ALSO:
EDITIONS
Available in: both Salesforce
Classic and Lightning
Experience
Available in: All Editions except Database.com
Report folders not available in: Contact Manager,
Group, and Personal
Editions
USER PERMISSIONS
To create, edit, or delete public document folders:
•
Manage Public
Documents
To create, edit, and delete public email template folders:
•
Manage Public
Templates
To create, edit, and delete public report folders:
•
Manage Reports in
Public Folders
To create, edit, and delete public dashboard folders:
•
Manage Dashboards
AND View All Data
374
Set Up and Maintain Your Salesforce Organization Recalculate Sharing Rules
Creating and Editing Folders
Click Create New Folder or Edit from most pages that list folders.
1. Enter a
Folder Label
. The label is used to refer to the folder on user interface pages.
2. If you have the “Customize Application” permission, enter a unique name to be used by the
API and managed packages.
3. Choose a
Public Folder Access
option. Select read/write if you want users to be able to change the folder contents. A read-only folder can be visible to users but they can't change its contents.
4. Select an unfiled report, dashboard, or template and click Add to store it in the new folder. Skip this step for document folders.
5. Choose a folder visibility option:
•
This folder is accessible by all users, including portal users
gives folder access to all users in your organization, including portal users.
•
This folder is accessible by all users, except for portal users
gives folder access to all users in your organization, but denies access to portal users. This option is only available for report and dashboard folders in organizations with a partner portal or Customer Portal enabled. If you don't have a portal, you won't see it.
•
This folder is hidden from all users
makes the folder private.
•
This folder is accessible only by the following users
allows you to grant access to a desired set of users:
a. Choose “Public Groups”, “Roles,” “Roles and Subordinates,” “Roles, Internal and Portal
Subordinates” (if you have portals enabled), “Territories,” or “Territories and Subordinates” from the
Search
drop-down list. The choices vary by Edition and whether your organization has territory management.
Note:
When you share a folder with a group, managers of the group members have no access to the folder unless those managers are also members of the group.
EDITIONS
Available in: All Editions except Database.com
Report folders not available in: Contact Manager,
Group, and Personal
Editions
Document folder restriction is available in: Enterprise,
Performance, and
Unlimited Editions
USER PERMISSIONS
To create, edit, or delete public document folders:
•
Manage Public
Documents
To create, edit, and delete public email template folders:
•
Manage Public
Templates
To create, edit, and delete public report folders:
•
Manage Reports in
Public Folders
To create, edit, and delete public dashboard folders:
•
Manage Dashboards
AND View All Data
b. If the
Available for Sharing
list does not immediately display the desired value, enter search criteria and click Find.
c. Select the desired value from the
Available for Sharing
list and click Add to move the value to the
Shared To
list.
Note:
You can use enhanced folder sharing to give your users more detailed levels of access to reports folders and
Report or Dashboard Folder.
6. Click Save.
SEE ALSO:
375
Set Up and Maintain Your Salesforce Organization Recalculate Sharing Rules
Deleting Folders
You can only delete folders that are empty. Before you begin, remove all the documents, dashboards, templates, or reports from the folder you would like to delete.
1. Click Edit next to the folder name from any page that lists folders. On the Reports tab, click then Edit in the Folders pane.
2. Click Delete or
then Delete.
3. Click OK to confirm.
SEE ALSO:
EDITIONS
Available in: both Salesforce
Classic and Lightning
Experience
Available in: All Editions except Database.com
Report folders not available in: Contact Manager,
Group, and Personal
Editions
USER PERMISSIONS
To create, edit, or delete public document folders:
•
Manage Public
Documents
To create, edit, and delete public email template folders:
•
Manage Public
Templates
To create, edit, and delete public report folders:
•
Manage Reports in
Public Folders
To create, edit, and delete public dashboard folders:
•
Manage Dashboards
AND View All Data
376
Set Up and Maintain Your Salesforce Organization Import Data Into Salesforce
Filing Items in Folders
To move a document, dashboard, report, or email template to a different folder:
1. Select the item to be stored in a folder.
2. Click Edit Properties.
3. Choose another folder.
4. Click Save.
Just like report folders contain reports and email template folders contain email templates, document folders can only contain documents. To store an attachment in a document folder, save the attachment to your computer and upload it to the document library.
Note:
Email templates that are used by Web-to-Case, Web-to-Lead, assignment rules, or escalation rules must be marked as “Available for Use.”
SEE ALSO:
EDITIONS
Available in: both Salesforce
Classic and Lightning
Experience
Available in: All Editions except Database.com
Report folders not available in: Contact Manager,
Group, and Personal
Editions
USER PERMISSIONS
To create, edit, or delete public document folders:
•
Manage Public
Documents
To create, edit, and delete public email template folders:
•
Manage Public
Templates
To create, edit, and delete public report folders:
•
Manage Reports in
Public Folders
To create, edit, and delete public dashboard folders:
•
Manage Dashboards
AND View All Data
Import Data Into Salesforce
You can import up to 50,000 records into Salesforce.
Important:
Salesforce has replaced the individual import wizards for accounts, contacts, and other objects with the Data Import Wizard. Individual import wizards open in small popup windows, while the Data Import Wizard opens in a full browser with dataimporter.app at the end of the URL. From Setup, enter
Data Import Wizard
in the
Quick Find
box, then select Data Import Wizard. The options you see depend on your permissions.
You can import data from ACT!, Outlook, and any program that can save data in comma-delimited text format (.csv), such as Excel or GoldMine.
Note:
If commas aren’t appropriate for your locale, use a tab or other delimiter. Specify your delimiter in Data Loader Settings (Settings | Settings).
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Your edition determines the types of objects you can import.
377
Set Up and Maintain Your Salesforce Organization Import Data Into Salesforce
The number of records you can import depends on your permissions and the type of data you’re importing. You can import as many records as allowed, as long as you don’t exceed the overall data storage limits for your org.
Type of record
Business accounts and contacts owned by you
Which records can be imported?
Import record limit Users permissions needed
50,000 at a time via the Data
Import Wizard
Import Personal Contacts
Learn more
Business accounts and contacts owned by other users
Person accounts owned by you
50,000 at a time
50,000 at a time
Modify All Data
Create on accounts
AND
Edit on accounts
AND
Import Personal Contacts
Person accounts owned by other users
50,000 at a time Create on accounts
AND
Edit on accounts and contacts
AND
Modify All Data
Leads
Campaign members
Custom objects
Solutions
Assets
50,000 at a time
50,000 at a time
50,000 at a time
Import Leads
Depends on what’s being imported:
•
Campaign member statuses
•
Existing contacts
•
Existing leads
•
Existing person accounts
•
New contacts
•
New leads
Who can import campaign members?
Import Custom Objects
AND
Create on the custom object
AND
Edit on the custom object
50,000 at a time Import Solutions
You can’t import these records via the Data Import Wizard.
What Is Imported for Solutions?
378
Изтегляне
Публичната връзка е актуализирана
Публичната връзка към вашия чат е актуализирана. You may view and manage your chat links after registration here.
Публична връзка към документа
Реклама
