1

I would like all Account's to be private, however users can see any Account enabled with Customer Community if that Account Owner is in the same Role as them.

Using "Account Access", by clicking on "Why?", I can see that the Customer's role created automatically had the "Reports To" field set as the same Role of the Account owner. Therefore, anyone in the same role as the Account Owner would see that person's Account's through Role hierarchy.

The OWD for Account sharing is set to private, the organization only has a single Role configured for all users, and Account Teams are used for individual sharing.

For context: we will probably enable Account Role Optimization, however in testing that doesn't solve this issue, since the "Reports to" for the Person Role behaved the same way in testing.

I need to prevent exposing customer Accounts to people in the same Role as the Account owner, when those Account's are enabled with customer community.

Improve this question
3
  • There is more going on than what is outlined above. In a Private sharing model, users in the same role DO NOT see each other's records by default. Access must be provided somehow. So, how are you (inadvertently) granting that access?
    – krigi
    Oct 4, 2019 at 23:48
  • There are no permission sets or sharing sets I can see, where else would you look?
    – ryguy
    Oct 5, 2019 at 3:09
  • rhetorical question. answer below.
    – krigi
    Oct 5, 2019 at 16:31

1 Answer 1

Reset to default
0

External Roles (PC or CC+) exist in the role hierarchy under their respective Account Owner's Role, although you cannot see them when you view the role hierarchy.

Sounds like your sharing model is:

  • Account = Private
  • Role Hierarchy = ONE role for all internal users.

Thus, all of your Customer and Partner Roles exist under this single role. This means that all internal Users can see Customer and Partner Accounts.

Sounds like you don't want this.

Try this:

  1. Create another leaf on your "flat" role hierarchy. The second role would not report to the first role, it would be a peer.
  2. All of your external Account's should be owned by individuals in this second role. Mind ownership skew...
  3. In this way, only the internal Users assigned to this new role would be able to see all Customer and Partner Accounts. For internal Users in the other role, they won't have visibility unless you grant it to them using tools you are familiar with like sharing rules, manual sharing, territory mgmt, etc.
  4. Adjust your sharing model for internal... while you may have solved visibility issues you were experiencing with external data, now your internal record visibility will need to be revisited in light of this additional role.
Improve this answer
1
  • Thanks @krigi, but still doesn't restrict Customer Account Owner's from seeing each other's Accounts with users in the same Role. This to me represents a fundamental problem with how Salesforce handled the Role hierarchy concept with Customer Accounts. I've decided to move all Customer Accounts to a single Admin owner in a top-level role, and all other users are members of a sub-role. I control access manually using sharing or account teams.
    – ryguy
    Oct 9, 2019 at 17:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .