0

I'm new to salesforce and I'm trying to understand the security model for my managed app. The app needs access to custom objects/tabs and field access for some standard objects. The app would be used by a Sales manager like profile in any org and should not be visible to other users. I understand that a system admin can configure assigned apps for any profile.

My question is that If I only give permission to the sys admin profile and let him/her give permissions to the different profiles based on assigned apps. Would that be enough? Will there be any issues in accessing custom objects/pages/fields?

How do other custom apps package permissions and profiles? Do I need a custom profile or permission sets for my app? I do not have experience here, would appreciate any help.

Improve this question

1 Answer 1

Reset to default
3

Admins are prompted for who to give access to. You do not need to provide profiles in your package, or give administrators permission on the default profile. However, you should include permission sets so admins can grant access to everything in your package to standard and custom profiles easily. This may be as simple as one default permission set for everything, two permission sets (one for managers, and one for sales people), or as complicated as you need it to be (but not any more complicated than it needs to be).

Improve this answer
5
  • Profiles included can be extremely helpful for custom objects so they can be merged with existing profiles. Does nothing for standard objects though. Imho though the permissions and the install process is not well undererstood by customers so permission sets are a must to help when installed as admin access only
    – Eric
    Jan 15, 2017 at 1:52
  • @Eric permission sets are the advised means of packaging permissions. Profiles are simply not as versatile, and merging profiles is difficult for a non programmer.
    – sfdcfox
    Jan 15, 2017 at 2:08
  • SF does it for you when you install. You apply the profile from the package to the profiles in the org and it will apply the settings related to your package to the org profiles. It only works on install though...
    – Eric
    Jan 15, 2017 at 3:39
  • @Eric That's useful info. I've been out of the ISV sphere for a few years now, so I'm glad to hear they included such a feature. Still, I'm also involved in DX, and while I won't say too much, I will say you should use Permission Sets...
    – sfdcfox
    Jan 15, 2017 at 3:42
  • yes you must have permission sets. But they can be a pain for site licenses. Have to apply them to each user and remember to do so with new users. They are a must I agree. Especially since profiles only work on install and are not propagated to the org. Future may be different though with DX. Eagerly awaiting that
    – Eric
    Jan 15, 2017 at 3:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .