Workaround to import Campaign Members w/o enabling "Modify All Data"

Question

We have a scenario where 18 users need the ability to add campaign members via an import file. This requires using Data Loader. However, these 18 users also have access to all Contact data across the network, meaning they need the system permission Modify All Data according to SF documentation since they are essentially adding contacts they do not own. This not acceptable since Modify All Data bypasses sharing rules, which we have worked hard to put in place to protect other standard and custom object data. Is there a known workaround or solution to this conflict in permissions?

Answer 1

Okay, so everyone's use case might be a little different, but here was the solution we came up with:

1) The users' profile did not have access to Leads (since the org was not using them). Event thought SF documentation doesn't explicitly cover this, they needed at least read access to the Lead object in order to use the "Manage Members" button on the Campaign record. NOTE: They will only have two options, however:

2) Under "App Permissions" (also on the profile) you have to check the "Import Personal Contacts" checkbox for them to have access to the new Data Import Wizard. This gives them the ability to use the Data Import Wizard, but NOT for adding Campaign Members since they would, in fact, need the "Modify All Data" permission which we are NOT going to give them. This is why the other two options are missing under the "Manage Members" button:

3) The users will still have the ability to add campaign members from a report using the "Add to Campaign" button after running a report.