1

I'm thinking to build an Integration Bot User with Standard Profile and 1 permission set that has Read Access (and no Edit Access) on all Objects in the Org. They also need Read-only to all records.

I have the requirement, then when a new Object is added to the Org, the same Permission Set be given Read Access automatically.

Is there a best practices for this requirement, or is Flow the best option here?

Also, if you disagree with this overall architecture, please provide a better one. I've read a lot of documentation/articles already, including on the API Integration License and Profile.

Improve this question
8
  • any new Object - including new standard objects? what about new objects added by managed packages? Why not just give the BOT user View All Data permission that allows all objects to be read.
    – cropredy
    Commented Apr 4 at 20:48
  • I found it! This just might fulfill the requirement
    – Ryan McNeely
    Commented Apr 4 at 21:57
  • System Permission: VIEW All Data - applies to every object; however, will not give FLS on the fields
    – cropredy
    Commented Apr 4 at 22:51
  • Thanks @cropredy I added the Sys Permission to my Permission Set, and I gave the user a Minimal Profile where all objects have "No Access". When I login as the User... Account, Lead and others objects are not available in the Waifer. What am I missing here? I thought Permission Set extends Profile, so if Account has No Access at the Profile level, but it has Read at the Permission Set level, then you can read all Accounts.
    – Ryan McNeely
    Commented Apr 5 at 18:13
  • I'm not sure what implications are involved with no Field Level Security, as you mentioned above. Please let me know if there is something I need to do about it.
    – Ryan McNeely
    Commented Apr 5 at 18:14

1 Answer 1

Reset to default
0

Thanks @cropredy for pointing me to Veiw All Data under System Permissions (on Profile or Permission Set). This automatically adds Read and View All to all objects, including newly added objects.

It does not change FLS or Tab visibility or other things you may need to view the Objects in the view.

In another question, System Permission set to View All Records. Why can't User view Account and other standard objects?

I asked more about API access for this Bot User, and got this from @sfdcfox: The new integration model replaces the older API Only System Integrations model (see Client Credentials Flow)

Since I have 400+ objects to update for FLS and Tab visibility, I'll create or find a Batch Job script to run for that.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .