4

With org wide defaults, and I'm not clear on what drives them. is it the most restrictive privilages for a user's role or profile? , In the foce.com fundamentals book, it's from the view of the profile, but it doesn't make sense why, since it has to do with record visability

http://www.salesforce.com/us/developer/docs/fundamentals/index_Left.htm#StartTopic=Content/adg_securing_data_org_wide_defaults_app.htm

1

2 Answers 2

2

The OWDs fall within the realm of data accessibility and therefore lie more with Roles and Sharing. To establish what your OWDs should be set to you should consider:

  • Who has the most restrictive data access requirement in your business? Baseline the OWD access level for that user/group e.g. if everyone has read/write permissions then set the object OWD as "Public Read/Write", but if you have several groups/roles and the most restrictive of these groups/roles should only have access to the record they own then you should set the OWD to "Private" and then "open up" the record access through sharing rules.
  • How master-detail relationships are going to impact your OWDs
  • Portal access requirements

Profiles instead are for managing access to functionality, and object and their fields (not records!).

1
  • so from the link I posted in the initial question, why does SF take it from a profile perspective? That's the part that's screwing with me Apr 8, 2013 at 16:43
0

Yes, your Organization-wide defaults (OWDs) are driven by the most restrictive needs. A user's view to the org's objects is primarily driven by their profile and then access to records is provided by the OWDs and augmented by sharing rules, roles, and various other options such as Opportunity Teams.

This makes sense when you take into account that Salesforce does not have any mechanism to DENY access, only to grant access. Given this, you must start with the most restrictive option and then start granting access.

Classic example: Private opportunities for your sales teams. You may want to set Opportunities to private to prevent poaching.

Edit

Removed incorrect references to how security works with regards to Profiles.

6
  • In practice, we have 100 profiles, and one of them should be now given read access. how does that effect my org-wide defaults. Do I need to modify it if it was set to private? Apr 8, 2013 at 14:59
  • You'll probably want to look at sharing rules, first. I'd recommend asking a (separate) specific question with details for the best answer.
    – Mike Chale
    Apr 8, 2013 at 15:08
  • Apologies for being contrary, but OWDs are part of the sharing settings within an Org and therefore are not driven by profiles.
    – Wes Nolte
    Apr 8, 2013 at 15:25
  • @MikeChale can you chime in? Apr 8, 2013 at 15:28
  • 1
    @WesNolte is correct and I misspoke. I'll update my answer to correct it.
    – Mike Chale
    Apr 8, 2013 at 16:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .