4

My employer, a company that is extremely conservative about who has access to company information, is considering a purchase from the SalesForce APP Exchange.

Part of the integration process is creating a new user and profile for the product. While reviewing the objects and fields the profile would be accessing, I discovered the "Note that on the User object, field-level security is only supported for custom fields, not standard fields" message.

Is there any way to protect some or all of the fields on the User object from an API user created for integration purposes?

Improve this question
1
  • I don't know much about it, but the user sharing feature might be what you need.
    – ca_peterson
    Commented Oct 6, 2014 at 17:24

2 Answers 2

Reset to default
3

You need to create a separate Profile for the API User account, and then manage its permissions through the Profile. You can go to Administer-->Security Controls-->Field Accessibility-->User and then select the "View by Profiles" option. You can use the Field Accessibility area to manage and control all your Profiles.

Improve this answer
0

Alternatively, consider purchasing Event Monitoring and implement a transaction policy that can block API requests, e.g., queries and many other operations, targeting specified fields.

Example: enter image description here enter image description here

https://help.salesforce.com/s/articleView?id=sf.enhanced_transaction_security_policy_types.htm&type=5

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .