Delegated Administration and record level access

Question

We have OWD Set to private for most of the objects. We have separate departments set up as top level roles in our role hierarchy. We share data within department using sharing rules. Separate departments should not be able to see each others data.

We need to setup different delegated administrators for different departments.

Is there a possibility that providing a user in one department with delegated administration access, user can himself access data from another department or can provide someone access to data from another department ?

Will it be safe to setup delegated administrators in each department without risking data access ?

Answer 1

There are a number of ways you can do this. It really depends on what type of access you want them to have for each object and additional permissions. If you just need the one user to have read-only access to the other departments' info, you don't need to create a Delegated Admin, you can just grant additional perms via the options below.

• You can create a Profile with View All access on the objects that you want the single user to have access to, then assign the profile to the users you selected. The downside here is for each department, if you want different levels of access, it could become a helluva-lot-a work to maintain. It's my least favorite option.
• You can create a permission set with the View all access for the objects you want the users to have visibility of. This gives you more flexibility for multiple levels of access without having to maintain numerous profiles. You can find the Permission Set Walkthrough here. Now if you are in Professional Edition with only 1 permission set available, probably not the best option. It is however, my favorite for EE/UE/Performance Edition.
• You can create a Public Group, then use sharing rules to grant read-only access to the users in the group. But this can be a PitA to maintain, who should be in the group when, the recalculation of rules, etc. It is, however, probably your best option if you have Professional Edition.

Now if you need them to be able to GRANT access to/manage users in specific roles, have administrative rights for resetting passwords, login-as, or creating custom fields, THEN you would want to look at setting up delegated admin users. But, again, for visibility, I recommend you create and assign a permission set with read-only access (via View All) to the objects the specified users need to see.