1

I used a sharing rule to provide the subordinate role (Inside Sales) to have Read/Write access to the accounts of the role above it (Admin). It works, but now the users of Inside sales cannot edit the accounts of the users in the roles below them. As they could before.... How do I make it so the Inside sales can read/write to the roles above and below them?

2

Sharing is cumulative; a sharing rule cannot reduce access provided by another means, such as the role hierarchy. As long as the users in a hierarchy are above others, they should still retain the same permissions. Either you're checking the wrong accounts, or you've found a bug that needs to be investigated by Support. There's no way to remove access to accounts owned by subordinates, since this feature is always enabled for standard CRM objects (e.g. Accounts). You can read more about this feature in Controlling Access Using Hierarchies.

  • Can users at the same level view/edit each other's records? – Boots Nov 22 '18 at 22:04
  • @Boots not without setting up sharing rules or other configurations. The role hierarchy only lets users see records for those below them. Sharing is a complicated subject. – sfdcfox Nov 22 '18 at 22:19
0

Since in the sharing rule, you have selected Share with = Role that's why the record is Read Write access to that particular users.

If you want the users below that role should have Read Write access then choose Share with = Roles and Internal Subordinates.

After changing this configuration, be sure to click on Recalculate button so that this role based visibility & access rights come into effect.

  • When I Edit the Sharing Rule There's no option to change the 'Share Withs' The fields are disabled. I created a new sharing rule. I configured it as follows: Account: owned by members of Role and Subordinates: Admin and Share with Role: Inside Sales. Now, the roles below Inside sales can see everything above (Admin). – Boots Nov 22 '18 at 20:50
0

Sharing will always provide you more access. There is no way to restrict access by writing sharing rules. I think in your scenario -

  • You will be able to edit Accounts owned by Admin because of the criteria based sharing rule.
  • You will be able to edit Accounts owned by user with role below Inside Sales because Grant Access Using Hierarchies is always enabled by default for Standard objects(Account here)

Here is what I did to test this in my org

  • Role Hierarchy

enter image description here

  • Criteria Based Sharing Rule enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.