How to allow users in specific roles to change the account owner

Question

I'm fairly new to Salesforce and am having trouble wrapping my brain around all the different permissions settings. So far the other guys on my team have been handling that stuff while I've been having fun with Apex. But, lucky me, they just handed me a requirement involving permissions. Two related requirements actually. And I'm a bit stuck.

First I should provide a little background: We're using Enterprise Edition. We have 50 offices and have structured our role hierarchy to look something like this (sorry about the spacing):

• OverallCompanyAdmin

  • Office1Admin
    • Office1Manager
      • Office1User

  • Office2Admin

    • Office2Manager

      • Office2User

      • etc.

The first requirement is to make it so that users in the OfficeManager role can change the account owner for any record where the account owner is a user in their office, but not in other offices ("Office" is a custom field on the user record). So, if there is an account owned by Office1UserA or Office1UserB, etc., Office1ManagerA should be able to change the account owner. But, Office2ManagerA should not be able to change the owners on those accounts. We have a number of sharing rules in place, as well as profile definitions, but it seems like we can only achieve all or nothing -- either the OfficeManager role can't change the owner on any accounts but his own, or can change owners on all accounts.

The second requirement is for dealing with "unassigned" accounts. We created a user named "Unassigned" who is in Office51. If an account is owned by "Unassigned," then any Office Manager in any office should be able to change the account owner (the idea being that if an account is unassigned, any office manager can reassign it). We created a sharing rule for the Unassigned user, but it's not working.

Is it possible to achieve these two requirements with the standard security tools in Salesforce? Or would I need to create an Apex sharing rule? By the way, I have read the Salesforce documentation, have read a bunch of other articles, and have pored through forums to try to get a handle on this and find a situation similar to mine, but I'm still not sure at all how to approach this. Any pointers would be greatly appreciated. Thanks.

Edit/Update:

I've spent some time digesting your responses and going over our security settings, and I've found that with the role hierarchy in place and the users assigned to the proper roles and the correct profiles, the OfficeManager role is able to transfer record ownership for users in his office. An OfficeManager is not able to transfer record ownership for other OfficeManagers in his office, but we can live with that.

However, I'm a little unclear on the suggestions about how to handle the "Unassigned" accounts. It appears that sharing rules do not confer the right to transfer ownership, and because in our company all users can see all accounts, we have not given that permission to the non-SysAdmin profiles. So I think that creating an "Unassigned" role and sharing it wouldn't achieve the desired result of allowing any OfficeManager to transfer ownership of an "Unassigned" account...unless we could somehow put "Unassigned" at very bottom of the role hierarchy. Is this possible?

Answer 1

Depending on how your permissions are set, then yes, this should be doable. A user can only transfer record ownership of records to which they have access, so people in Office 1 should be able to transfer their records around.

If people in Office 1 do have access to Office 2's records then you'll have problems. You could circumvent this with custom coding that enforces your business rules or (my recommendation) train users to not transfer records from outside of their office (and you could use field history to maintain an audit trail of ownership.)

The second part, for "Unassigned" accounts would be easy; just give every office manager access to those records via sharing rules.

Answer 2

@djackiem I think I do have a solution for your remaining problem. But unsure if you still want it - your question is 1 year old. If yes, just comment here and I will respond with my idea. cheers.

Answer 3

@djackiem No problem at all. I dont remember my solutions exactly right now. But this should work - you should give your office manager's profile "Modily All" on the accounts object. This will let them transfer them.

PS. you can still use private as OWD on accounts if you dont want to give your managers access to edit any records.

Do let me know if this works for you. or if it doesnt.