6

I understand the following:

  • Custom Report Types must use the Role Hierarchy
  • Reports using Role Hierarchy show all records below the current Role
  • Sharing Rules allow records to be shared with roles outside of their hierarchy

Our environment's current setup is Admin and Executive as siblings at the top with Executive having several children, grandchildren, etc. We have also setup our sharing rules so that every record owned by a user in any role is shared with every user in any other role.

Where my question really comes in is... Do custom report types respect sharing rules? Will a custom report type allow a user in Admin to view records under the Executive hierarchy if sharing rules are configured to do so? It seems related this question, but there is no definitive answer on there of whether or not reports respecting sharing rules or not.

The problem:

We have a custom report type displaying opportunities with a custom relationship. I'm trying to assist with building a report for a user and noticing some of the records (owned by an Admin) are not displaying for the user. This results in records a user can view - through all means: list views, layouts, apis - not being displayed in a report.

I want the user to be able to view the records even though they are outside of their role hierarchy. Does this mean we need to rebuild our hierarchy with 1 role at the top? If so, should our hierarchy be 1 role because we don't want to prevent users from running reports with data owned by users above them in the hierarchy, or are users allowed to go to parent hierarchies by clicking through the Role Hierarchy on the report?

Misdirection?

I always assumed reports using Role Hierarchy respected sharing rules - this concept makes sense to me because if a user has access to view the record, there is no reason to exclude it from a report. I also noticed using the standard activities report and saving the role hierarchy at the top in a split hierarchy like ours, I can view activities created by users outside of the admin hierarchy. Again, I would assume this would translate to the custom report types.

Walk-thru

As an admin, I run my report. I've added a filter for a specific opportunity ID to make it easier to identify for this example. I am set at the top of our Hierarchy Admin. enter image description here

I then look at that specific records Sharing Settings. I've highlighted the record ID as well as the user I'm going to login as. enter image description here

As the user, I run the report again; this time in the Executives role. As mentioned above, the Executives role is a sibling of Admin and also at the top. You'll notice the record does not appear. enter image description here

Finally, as the user, I go to the specific record. You'll notice the record is visible. Also, the field Associate is visible - this is a custom field and why we made the custom report. We wanted to display information from this parent record on the opportunity report. enter image description here

Improve this question
3
  • Custom report types respect sharing rules. They have to, otherwise it would be too easy to inadvertently create a security hole.
    – cropredy
    Commented Mar 15, 2016 at 4:06
  • @crop1645 I agree with you! However, that's not what I'm seeing - and maybe the answer is this is a bug. I've updated my answer with some screenshots walking you through what I'm experiencing.
    – zainogj
    Commented Mar 15, 2016 at 13:01
  • If you are sharing every record with every other role then it would seem the object needs to be set to Pubic read or Public read/write.
    – Eric
    Commented Mar 17, 2016 at 0:40

1 Answer 1

Reset to default
4
+50

It would seem that Custom Report Types drilled down to the Users Role DO NOT respect the sharing rules ADDING records that the role would not normally see with the Hierarchy alone...

Idea: https://success.salesforce.com/ideaView?id=08730000000kzURAAY

Knowledge Article: https://help.salesforce.com/HTViewSolution?id=000004564

It seems counter intuitive but if it is drilled down to a Role then it may make sense to only show record for that role and not all visible records....

Either way an answer in the Idea shows how to resolve it:

Salesforce Tier3 support and they've explained that you can solve this by creating a "Global" role that sits above all other roles in the system, and then save your custom reports set with "Global" as the hierarchy level. That means that sharing rules will not be "overridden" by hierarchy

https://help.salesforce.com/apex/HTViewSolution?urlname=Best-practices-around-role-hierarchy-in-relation-to-activity-and-opportunity-reports&language=en_US

OR

Since you are sharing every record with every other role then it would seem you could set to sharing to Pubic read or Public read/write

Improve this answer
4
  • Who knew?! Nice work. I
    – cropredy
    Commented Mar 17, 2016 at 1:11
  • Wow, thanks for the articles and links. I don't have time to review in full at the moment; I'll take a look later today. I had a suspicion the counter intuitive argument was in play. The only piece left hanging for me right now is, why is this not the case for the Standard Activities report? When I run that in my admin hierarchy I can see all records shared. Also, your comment above about Public Read, etc; this makes sense as well. They are set to private because we have a portal - the portal users are outside of our sharing rules.
    – zainogj
    Commented Mar 17, 2016 at 12:25
  • 1
    You can make public internal and private external afaik
    – Eric
    Commented Mar 17, 2016 at 12:27
  • Thanks for all the help. I guess my other question about Task visibility working is answer in the Knowledge Article; ultimately standard reports function differently that custom reports. All really interesting. Now I just need to evaluate which is a better and more efficient approach to implement.
    – zainogj
    Commented Mar 17, 2016 at 22:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .