0

I've got a Test User on a Salesforce License with the lowest Role possible using the Standard Profile. The OWD for Opportunity is set to Public Read Only

The OWD for Account is set to Public Read Only

The Owner of the Opportunity and its Account is a different user on a much higher role

There are no sharing rules on the Opportunity Object

There are no Sharing Overrides on Opportunity apart from System Administrator profile which has view all / modify all.

There are no Sharing Overrides on Account apart from System Administrator profile which has view all / modify all.

The Role the User is on is set to View All opportunities with accounts that they own. However they don't own the Account in question so it should have no impact.

I also tried making the Opportunity record owner be in a totally unrelated role so that the Test User is not included in Roles and Subordinates but that made no difference.

I then looked at the Sharing in Salesforce Classic for both the parent Account and the Opportunity record and saw no reason why the Test User should have edit rights on the Opportunity Record

I did a SOQL on the OpportunityShare table and that also verified no sharing rules giving the Test User access

I've re-calculating sharing rules multiple times and logged both myself and test user in and out multiple times.

I was thinking that Opportunity to Account is a special Salesforce Master Detail relationship but given there are no settings giving the Test User edit access on Account either that theory doesn't hold up.

What have I forgotten to check? Why does my Test User have edit rights on the Account and Contact? Is it because the record owner, who owns both records, is a Sys Admin?

Improve this question
5
  • Can you check in the opportunity sharing button to see why Test User have edit access, probably check the RowCause field too.
    – jaiaswani10
    Jun 16 at 7:28
  • SOQL SELECT Id, OpportunityId, UserOrGroupId, OpportunityAccessLevel, RowCause FROM OpportunityShare where OpportunityID = '0062w00000MnDhHAAV' returns only one Share Record with a RowCause of Owner
    – Matthew Harris
    Jun 16 at 7:35
  • I added the Sharing Hierarchy button to the page layout in Lightning and it shows only the 3 System Administrators should have Edit rights.
    – Matthew Harris
    Jun 16 at 7:36
  • oh, you have View all modify all permission assigned to your user's profile, that's why you are able to edit. Does Test User is part of Salesforce Admin profile?
    – jaiaswani10
    Jun 16 at 7:42
  • No I didn't give my Test User sys admin rights. Nor did I give them view all or modify all.
    – Matthew Harris
    Jun 16 at 12:56

1 Answer 1

Reset to default
0

If the user has edit access to the parent account record, then they could be getting the same level of access to the child opportunity record due to implicit sharing.

Here are a few things I'd try:

  • Checking whether they've been added as an Opportunity Team Member to the oppy
  • Checking whether they've been added as an Account Team Member to the parent account
  • Checking whether they have been granted access to the account or oppy due to Territory Management
  • Checking the AccountShare table to see whether and why they have edit access to the account
  • Troubleshooting by changing the OWD of the account and/or oppy objects
  • Removing the user's role/removing their permission sets/changing their profile to see if that makes a difference (then eliminating possibilities one by one)
  • Installing the User Access and Permissions Assistant and using it to analyse the permissions that have been granted to the user in question
Improve this answer
1
  • Implicit Sharing appears to be the cause based on trial and error. When I mark Opportunity as Private in OWD it respects the configuration and Test User cannot see Opportunities but as soon as I give the Test User visibility of Opportunity by any means it inherits Edit Access from the Account via Implicit Sharing. This is frustrating a the user interface gives you the option to choose Read Only, it just doesn't respect it.
    – Matthew Harris
    Jun 18 at 1:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .