0

Does anyone have any ideas on how to restrict users from running a report in Salesforce without permission? Basically an approval process for running reports? A client recently had someone steal data and they want to implement a way to prevent them from downloading information without permission. I know there are ways to audit system logins, etc. through audit toosl in SF; however, that is after the fact.

They would just like a way to have someone request access to a report and then have the system allow them to run it.

Improve this question
1
  • 1
    If you want to just restrict the user from downloading report, disable Export Report option on the user profile. The user can still copy the 2000+ record data from the screen.The report access is controlled by the folder. Essentially you can assign / remove a user from a report folder and control access to the reports you want to. You can create your own approval flow by creating a custom object which holds the list of approvers. on approval you can have a trigger that will add the user to the report folder.
    – Rao
    Commented Mar 31, 2017 at 20:58

2 Answers 2

Reset to default
1

Your best choice is to configure Organization Wide Defaults and Sharing Rules. Do not give normal users access to more records than they should have access to. While reports makes it easier to steal data, the most important thing is that a dedicated thief could simply navigate to every single record available via list views to get to the data if they really wanted to. Configuring sharing in a way that users can't view more than they should is the only surefire way to make sure that the damage is limited just to a small set of records they can view. The more permissions and sharing you grant to a user (e.g. by placing them higher in the org hierarchy), the more data they could see and potentially copy. This is commonly called the Principle of Least Privilege (Wikipedia) and should be observed as much as practical. Users can't retrieve data they can't see.

Improve this answer
0

I am assuming that you want to avoid users to run reports that they should not run.

I restrict the access for reports using the Report Folders. You can give access by user, by role and so on. So you can avoid users run reports that you do not want. Also, it is important to avoid that they create new reports. You can find references here You can give Permissions in Report folder thru the pin (left side of the folder).

enter image description here

Improve this answer
1
  • Thanks everyone! I will present these options to the client.
    – Shannon113
    Commented Apr 2, 2017 at 11:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .