I am attempting to allow a group of Force.com OneApp users to be able to Modify All on a custom object that is the child in a Master-Detail relationship with Account. The security access on our Account object is rather complex, and I'm not particularly excited about making my custom object Lookup to Account and try to figure out how to keep in sync everyone with Account access being able to see the custom object. That being said, it appears I can click the checkbox for Modify All access on the child of a master-detail object in the Profile page, but I get an error telling me that the OneApp user needs to also have Read All access to Accounts (which is not a checkbox that is available -- only Read). I am wondering if there is any way around this?

EDIT: To clarify, the goal here is to have a small group of people who are only concerned with the custom object to be able to edit all of them. They don't have any interest in the parent object (a different batch of people leverages most of the other objects), but there is no issue with giving them Read access to all the accounts.

  • There's no option for View All?
    – Mike Chale
    Oct 2, 2012 at 20:49
  • Not on Account, only Read. View/Modify All is available for the custom object, but an error is thrown because Account isn't set to View All. Oct 3, 2012 at 0:39

2 Answers 2


If you must have independent access to the child I'm guessing the relationship has to be a lookup rather than master detail.

  • I think this is the path I'll have to go (with custom APEX sharing and dealing with consistency when security chanages) Oct 3, 2012 at 0:40
  • Cool. Also if it isn't mandatory for the users to be on the Force.com One App Profile, I noticed custom profiles do let you have View All on Accounts. Oct 3, 2012 at 8:05
  • Since these users only need a very small subset of the data, we aren't interested in paying for the full license. Oct 3, 2012 at 14:17

You need At least Read visibility on the Parent to be able to view the Child objects. The child inherits the sharing settings from the parent, and therefore everyone who has access to the parent record will be able to view the child records so long as their profile has Read permission on the Child Object.

So in response to your question, the platform will sort out the visibility of detail records based on the master. You don't need to explicitly grant View All on the profile.

  • To extend what I said there, just grant Read, Create, Edit and Delete permissions for the custom object on the User Profile. Oct 2, 2012 at 17:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .