I've been going back and forth most of the day today with both Salesforce's CPQ Team AND our implementation partner with regard to whether or not we should install Salesforce CPQ for
All Users, or whether we should install for
Admin Only and use the included
Salesforce CPQ User and
Salesforce CPQ Admin permission sets to control access/visibility into specific objects in the app.
Both the Salesforce team AND the implementation partner are suggesting that I install for
All Users. One Salesforce Engineer even went so far as to tell me that I should install for
All Users and then use the Permission Sets to assign appropriate access to people based on their needs.
However, when I ran a test in our Full Copy Sandbox of running the Install for
All Users, the end-result was that our Sales team members with a Custom Profile had a much higher level of access to Salesforce CPQ Objects and features than I want them to have. I understand that Full Copy Sandboxes ignore Managed Package license assignments/restrictions, but sandboxes do still honor CRED/FLS/Sharing.
After the install, Sales users were able to create Product Rules, Discount Schedules, and other components that I thought should be considered "Admin". Far above and beyond the expectation I have for them of creating opportunities, quotes, quote line items, quote documents, etc.
I uninstalled the app, and re-installed it for
Admin Only, and then the Sales user had no access to anything. I then assigned the Sales User to the
Salesforce CPQ User permission set and they had access to do CPQ Quoting as expected, and nothing else.
I then went back to all parties and asked them to clarify the point of the Permission Sets if we use the
All Users option which seems to grant elevated access by default, and I even referred them to this help article https://help.salesforce.com/articleView?id=distribution_perm_sets_profile_settings.htm&type=5 which clearly states that Permission Sets can be updated at any time during managed package updates versus profile permissions which states that Only permissions related to new components created as part of the install or upgrade are applied., but everyone is still sticking to their message that we should install for All Users.
Ultimately, my question is: Am I right in my assumption that installing for
All Userswill give CRED/FLS access to the profiles that we might not necessarily want to grant, and that in order to solve for that problem I would have to go back to each of our 25+ custom profiles and start removing CRED access to these extra objects? I'm certified in Sharing and Visibility design, so I am no stranger to how the security model works, but everyone is telling me that I should still install for
All Users. Why?