The Site.createPortalUser call requires an Account ID to be specified. But what impact does that Account ID have on the access rights of the User that is created? (I haven't managed to find any detailed documentation on this.)

I have a customer who wants portal users to be able to access information about Contacts contained in peer Accounts but am unclear what (if any) constraints the platform imposes on such access.


The platform impact is that the portal/site users are situated under a single Account and its Owner in the Role Hierarchy. The portal user role is a subordinate of the account owner's role, therefore, all data for the portal user role rolls up to the portal account owner's role.

This ensures that portal users from different accounts never see each other's data. It's been a while since I've done it myself but you can create sharing rules so that users with the Manager license from different accounts can see each other's data.

The portal/site users don't participate in the traditional sharing model and instead are restricted to the fixed roles that are automatically created under the Account that is their parent.

There are 4 roles in this hierarchy under the Account:

  • Account
    1. Executive
    2. Manager
    3. User
    4. Person Account

If you have a partner community / portal with partner users logging into the system related to an Account named Acme Widgets, under this Account you'll have these roles to which your portal login-enabled Contacts can be assigned:

  • Acme Widgets
    1. Acme Widgets Partner Executive
    2. Acme Widgets Partner Manager
    3. Acme Widgets Partner User
    4. Acme Widgets Partner Person Account

Some documentation: Portal User Management


In and of itself, the AccountId has no impact on the access rights of the User until permission sets or sharing rules are applied.

The basic profile of a PortalUser isn't dependent on the AccountId. It's the license type that impacts what the profile will have access to. Obviously, an AccountId is required for a customer Portal. If you're talking about a Partner Portal, the AccountId will affect which child Accounts the user will have access to, which again is a matter of sharing rules and permission sets that are subject to what the base license allows that type of portal license or community user license user to have access to.

The only exception to this that I can think of would be where there are other licenses which can be used that a common AccountId are applied to. For example, in some sites, an org might apply a guest user license to a common "dummy account" and restrict the permissions of those users compared to the users who have a full license to use that portal, site or community. But again, that's really a matter of permissions that have been assigned to a particular profile and/or user. In the example cited, that's a different profile than the primary profile assigned to "registered" users; thus the reasons for the limitations and restrictions placed on it.

Depending on the type of "Portal", "site" or "community" license you have, sharing contact information between Users from the same account may or may not be a simple thing to do. Each license is different and the sharing models can vary significantly. Having an account in common would simply be one of the criteria used as part of the sharing rules used to grant the permission.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.