1

I am confused with OWD and Profile. If an Object is set as Public Read-Only at OWD level and give write permission at Profile level, can the user edit the records? Is this the way to override OWD settings?

Thanks!

  • 2
    Please choose your tags to match your question's content. This question does not bear upon communities, Salesforce1, or the Id values. – David Reed Apr 30 '18 at 13:50
3

Profile Permission means do you have the ability to read or edit(OBJECT BASIS), Can I edit account?

OWD means do you have access to that record or not(RECORD By RECORD BASIS). Do I have access to edit this specific account record?

So coming to your question. OWD is Read Only. So you have Minimum Read Access to that.

Even if your profile has edit permission, as you don't have edit access to that record you wont be able to edit.

Profile(It means Permissions) OWD or Sharing(Do you have access to that record)

Ofc, OWD is most restrictive permission, You can open up your access using Sharing Rules, Territories,Apex Sharing/Manual Sharing.

NOTE: If your profile has View ALL or EDIT ALL permission than no matter what OWD is you will be able to access any records.

  • Correct. The way to "override OWD settings" is either by way of "View All / Modify All", or Sharing features. – Charles T Apr 30 '18 at 14:42
1

The answer is "it depends". There are numerous ways to control security and access to records. Setting OWD and creating Profiles are just "pieces of the puzzle" or some of the tools available to administrators for controlling record access.

At an Object level, when an Object is Read Only, that represents the "potential" for a User to be able to see a Record. If the user doesn't have Read permissions on any of the fields beyond the Id, Name, Last Modified, Owner and RecordType (the typical defaults that Object level Read gives a user), they won't see much will they? Even if they do have those permissions, they also need permission to access the Object's Tab in order to access any records or else permission to access a custom visualforce page that displays those records.

If the object has RecordTypes, the user could have Read permission at the Object level, but not have any permission to view the RecordTypes available, thus preventing them from viewing any of the records at all!

Not only is record access controlled by Profiles, it can also be expanded through Roles. If Role Hierarchies are enabled, users can obtain access to records from users below them in the hierarchy. This feature can be disabled for a Custom Object via a checkbox at the time it's created to prevent sharing records through the hierarchy.

Permissions in a Profile cannot be restricted or removed, they can only be expanded. One way of granting additional permissions is through Permission Sets. Those are usually assigned individually to Users. Rather than having to create a new custom profile, an administrator can simply create a permission set and assign it to a user to give them additional access to objects, fields and various kinds of permissions or license features available on the platform.

There are additional ways of expanding record sharing that include Sharing Groups, Apex Managed Sharing, and Conditional Sharing that immediately come to mind as well. Those typically wouldn't apply to the situation you've asked about, but are other tools that are generally available for things that can arise.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.