Scenario: If I had a Custom Profile / Standard Profile, say Sales,and I have 50 Users assigned to the same Profile and had same Permission / Access on a particular object (Could be Standard or Custom Object), if I were to Hide a Field ONLY TO ONE USER, which would be a better Solution to achieve this WITHOUT EDITING OR TOUCHING THE PROFILE??

Option 1: Create a Custom Profile for this particular User and give CRED access (I know this one isn't a good solution as I got a Thumbs-down from a Technical Architect)

Option 2: Create a Permission Set - Go to the particular Object,say, Accounts, Object Permission Enabled -->Field Permissions-->Remove READ Access - This would make this particular field hidden from the Object to the Profile. Then Assign this Permission to particular User whom I don't want to see this field.

I would go with the 2nd option but I still hear a groan. Where am I going wrong? How would you hide a particular field from ONE User out of 10 Profiles who have the same Access Rights?enter image description here

What's the best possible solution to hide a Filed from only one User out of 10 Users who have the same Profile.

  • 3
    Santanu's answer applies to all forms of access. If a user has permission for something either at the profile or at the permission set, then they have access. You can't use permission sets to restrict permissions, only add them. This is true for classes, pages, objects, fields, user permissions, and so on. – sfdcfox Apr 27 '17 at 3:23

You could try an encrypted field. It will show up as **** and then create a permission set that allows your other users to view it.

This may help: http://developer.force.com/cookbook/recipe/storing-and-displaying-confidential-information

  • @SushmaTiwaari This makes no sense. If you are going to do that then remove the access from the profile and use a per set to allow visibility like the other answer suggests and it is the same process. Adding permissions to view the encrypted field also allows those profiles to view other encrypted fields. This is not a good resolution at all and has side effects that are not what the OP intended. Surprised it was accepted. You refusal to modify the profile to do this properly is confounding – Eric Apr 27 '17 at 15:05
  • The other responses here are better solutions for sure, but if their requirements are to not be able to change the profile at all OR create a new one then they don't meet the need. I, for one, would agree that it's better to ensure that the requirements are correct, but if they are, then the other answers don't meet the need even if they are considered best practice. This fulfills their requirements (though it's not ideal) where others did not. – Scott Walker Apr 27 '17 at 15:33
  • Then they create a formula field to show the value if not that user and if that user display nothing. Then remove permission from the original field. That would be a better solution than view encrypted. Either way they have to update field permissions (adding a field etc) and ultimately update the profile (via adding or editing field permissions) so there is really no way around it. Providing view encrypted permissions is not they way to go IMHO – Eric Apr 27 '17 at 16:39
  • It's not the best way, but your solution still doesn't meet the don't edit the profile requirements. Also, if you have just a formula field on the layout it prevents input. The best way to handle it is what was suggested elsewhere, but that doesn't meet the requirement of not editing the profile or creating a new one. – Scott Walker Apr 28 '17 at 17:14
  • My solution is the same as yours just with a different field. Yours has to create a encrypted field, mine just creates a formula field. If you read my comment carefully there really is no way NOT to modify the profile if you consider updating a field's visibility as a profile update. – Eric Apr 28 '17 at 17:54

You should opt for Permission set.

Only thing is that permission cannot be revoked through the use of permission set.

So, create/edit profile with minimum permission (without READ access) and create permission set to open up the access (giving READ access) and finally assign the permission set to users who should READ the field.

If your profile has read access to the field and if you create a permission set without read access to that field, then user will still have read access due to profile permission.

  • The instructions given to us was NOT to Create or Edit the Profile. I have hidden a Field to a User before , but just cannot remember how it was done for that Project. Let me explain the scenario again - 50 Users have the same Profile. The Task here is to hide a Field from ONE User out of those 50 users who share the same Profile. – Sushma Tiwaari Apr 27 '17 at 13:44
  • According to this scenario, Clone the profile and create a new profile and remove FLS of that field and assign to that user – Santanu Boral Apr 27 '17 at 13:47
  • I repeat - The instruction given to us was NOT to CREATE a new Profile or to Clone a Profile. Would have created a Custom Profile and removed access to this User if we had the luxury to do so..But we are bound by the instructions.. – Sushma Tiwaari Apr 27 '17 at 14:03
  • So, you can't change the existing profile? correct? – Santanu Boral Apr 27 '17 at 14:05
  • Yup. That is correct. – Sushma Tiwaari Apr 27 '17 at 14:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.