2

I am currently admin for an org which uses installed packages that are essential to business processes. As a caveat to having these packages I must keep my Sharing Settings to Public Read/Write for certain objects.

With these settings our Sales Rep users are able to see all records of the public read/write objects.

Is there a way to create groupings of records I can assign to a Role and restrict all other records of the same type without changing the Orgs Sharing Settings?

Thank in advance for your help.

--

Extension: The app we need Public Read/Write permissions for is Mailchimp 4 Salesforce (MC4SF) which creates Leads in Salesforce after a sync.

I have had a reply from MC4SF: "We do require those Sharing Settings to be set to "Public Read/Write" for Leads, Contacts and Accounts. Due to the way the MailChimp for Salesforce integration interacts with Salesforce, without those public settings, we'd be unable to create new Leads from MailChimp subscribers and we may run into issues with syncing MailChimp subscribers to existing Contacts/Leads, querying Leads/Contacts to add them to MailChimp lists, specific groups or segments, or even associating MailChimp campaign activity (opens, clicks, etc) with Contacts/Leads in Salesforce."

Ideally we want to keep our Sharing Settings locked down and then open up access using Territory Management and Role Hierarchy. I also am looking for confirmation (in salesforce documentation) of how installed packages are affected by sharing settings in an org. I have searched and found nothing that relates them.

Improve this question
7
  • I can't think of a way to do so. If you have public read/write you can't restrict record access. You might want to think about record encryption, but this is way too far. I would go back and look at installed packages (may be find alternatives) and try to get records to private.
    – Amr Ibrahim
    Commented Oct 25, 2016 at 4:16
  • You can use record types and make vislble for corresponding user profile. So user belongs to that profile will see or access records of that assigned record type. I am not sure if this is a concrete solution.
    – Reshma
    Commented Oct 25, 2016 at 4:29
  • profile doesn't govern record level visibility
    – Santanu Boral
    Commented Oct 25, 2016 at 4:49
  • Have a look on this post as well salesforce.stackexchange.com/questions/53698/…
    – Amr Ibrahim
    Commented Oct 25, 2016 at 5:04
  • 1
    Thanks @AmrIbrahim for the link. It does clarify that my current implementation is not something that is feasible. However I do need some sort of solution with regards to MC4SF and any other installed packages we may want to use later.
    – Malaki Toleafoa
    Commented Oct 25, 2016 at 21:00

1 Answer 1

Reset to default
0

According to your requirement, you have to define OWD of the object to "Private". Then create role hierarchy or public groups to open up to access (either Read-Only or Read-Write) upon creating sharing rules to other users whom you want to share the records.

Along with the record level sharing, the object should have at-least Read access to the profile or in permission sets.

There is a nice trailhead Control Access to Records which will help you to clear the doubts on record level sharing.

Improve this answer
1
  • Thanks for the reply. My ideal implementation would be to make all records private and then opening up access to certain records using Territory Management, Role Hierarchy and Sharing Rules. However I am looking for a workaround if somebody has one for Sharing Settings and installed packages, specifically Mailchimp for Salesforce.
    – Malaki Toleafoa
    Commented Oct 25, 2016 at 21:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .