I'm fairly new to Salesforce and am having trouble wrapping my brain around all the different permissions settings. So far the other guys on my team have been handling that stuff while I've been having fun with Apex. But, lucky me, they just handed me a requirement involving permissions. Two related requirements actually. And I'm a bit stuck.
First I should provide a little background: We're using Enterprise Edition. We have 50 offices and have structured our role hierarchy to look something like this (sorry about the spacing):
The first requirement is to make it so that users in the OfficeManager role can change the account owner for any record where the account owner is a user in their office, but not in other offices ("Office" is a custom field on the user record). So, if there is an account owned by Office1UserA or Office1UserB, etc., Office1ManagerA should be able to change the account owner. But, Office2ManagerA should not be able to change the owners on those accounts. We have a number of sharing rules in place, as well as profile definitions, but it seems like we can only achieve all or nothing -- either the OfficeManager role can't change the owner on any accounts but his own, or can change owners on all accounts.
The second requirement is for dealing with "unassigned" accounts. We created a user named "Unassigned" who is in Office51. If an account is owned by "Unassigned," then any Office Manager in any office should be able to change the account owner (the idea being that if an account is unassigned, any office manager can reassign it). We created a sharing rule for the Unassigned user, but it's not working.
Is it possible to achieve these two requirements with the standard security tools in Salesforce? Or would I need to create an Apex sharing rule? By the way, I have read the Salesforce documentation, have read a bunch of other articles, and have pored through forums to try to get a handle on this and find a situation similar to mine, but I'm still not sure at all how to approach this. Any pointers would be greatly appreciated. Thanks.
I've spent some time digesting your responses and going over our security settings, and I've found that with the role hierarchy in place and the users assigned to the proper roles and the correct profiles, the OfficeManager role is able to transfer record ownership for users in his office. An OfficeManager is not able to transfer record ownership for other OfficeManagers in his office, but we can live with that.
However, I'm a little unclear on the suggestions about how to handle the "Unassigned" accounts. It appears that sharing rules do not confer the right to transfer ownership, and because in our company all users can see all accounts, we have not given that permission to the non-SysAdmin profiles. So I think that creating an "Unassigned" role and sharing it wouldn't achieve the desired result of allowing any OfficeManager to transfer ownership of an "Unassigned" account...unless we could somehow put "Unassigned" at very bottom of the role hierarchy. Is this possible?