System Permission set to View All Records. Why can't User view Account and other standard objects?

Question

I created a Permission Set and made one change on it: System Permission: "View All Records"

I gave it to a User with Standard Profile.

When I tested as this user, it could Update and Delete records of Account, Lead, etc. This doesn't work for me. I want Read-only across the board.

So I changed the User to "Minimal" profile, where all Object Permissions are set to "No access". It still has the Permission Set.

Now, when I login as the User, objects do not appear in the Wafer (object explorer).

What else do I need to configure to truly have Read only to all records in Salesforce?

Answer 1

View All Records doesn't include metadata (things found in Setup). Add View All Users to allow them to see users.

Answer 2

Given that System "View All Data" implies/grants/gives "Read" and "View All" access (in object permissions)...

I suspect why your test user cant see object(s) in the wafer might be because those objects still need a "Tab" defined, and defining a Tab for an sobject is what makes it eligible to appear in that ui.

Answer 3

Thanks sfdcfox and peter for putting me on the right path.

For each FLS on a particular Permission Set, there's a FieldPermissions record in the background. This script went through over 500 objects in my org, setting every settable field to Read. Combined with System Settings: View All Data and API access, and this Permission Set I created for him, my User can pull all needed data into an external data lake.

public with sharing class PermissionSetUpdateBatch implements Database.Stateful, Database.Batchable<String> {
private String INTEGRATION_BOT_PERMSET_ID = [SELECT Id 
                                             FROM PermissionSet 
                                             WHERE Label = 'Integration Bot View All Records'
                                             LIMIT 1].Id;
private Map<String, Schema.SObjectType> globalDescribe = Schema.getGlobalDescribe();
private List<FieldPermissions> fieldPermissionsList = [SELECT Id, Field 
                                                       FROM FieldPermissions 
                                                       WHERE ParentID =: INTEGRATION_BOT_PERMSET_ID 
                                                       AND PermissionsRead = true];
private Set<String> fieldsWithPermReadTrue = new Set<String>();

public Iterable<String> start(Database.BatchableContext context) {
    System.debug('>>> INTEGRATION_BOT_PERMSET_ID: ' + INTEGRATION_BOT_PERMSET_ID);
    System.debug('>>> fieldPermissionsList: ' + fieldPermissionsList);
    
    for (FieldPermissions fp : fieldPermissionsList) {
        fieldsWithPermReadTrue.add(fp.Field);
    }
    System.debug('>>> fieldsWithPermReadTrue: ' + fieldsWithPermReadTrue);

    List<String> objApiNames;
    System.debug('>>> objApiNames: ' + objApiNames);
    if(Test.isRunningTest()){
        objApiNames = new List<String>();
        objApiNames.add('order');
    } else {
        objApiNames = new List<String>(globalDescribe.keySet());
    }
    return objApiNames;
}

public void execute(Database.BatchableContext bc, List<String> objectApiNames){
    List<FieldPermissions> fieldPermissionsForInsert = new List<FieldPermissions>();
    
    for (String objectApiName : objectApiNames) { // loop all SObject
        //EntityDefinition ed = (EntityDefinition)record;
        System.debug('------- objectApiName: ' + objectApiName);

        // get the describe for each individual object
        Schema.SObjectType sobjectType = globalDescribe.get(objectApiName);
        System.debug('------- sobjectType: ' + sobjectType);
        Schema.DescribeSObjectResult objectDescribe = sobjectType.getDescribe();
        
        Map<String, Schema.SObjectField> objectFields = objectDescribe.fields.getMap();

        for (String fieldApiName : objectFields.keySet()) { // loop all fields per object
            System.debug('>>>> fieldApiName: ' + fieldApiName);
            Schema.SObjectField sobjectField = objectFields.get(fieldApiName);
            String objectDotField = objectApiName + '.' + fieldApiName;
            
            if (!fieldsWithPermReadTrue.contains(objectDotField)) {
                 FieldPermissions newFP = new FieldPermissions();
                 newFP.ParentId = INTEGRATION_BOT_PERMSET_ID;
                 newFP.SObjectType = objectApiName;
                 newFP.Field = objectDotField;
                 newFP.PermissionsRead = true;
                 fieldPermissionsForInsert.add(newFP);
            }
        }
    }
    Database.insert(fieldPermissionsForInsert, false);    
}

public void finish(Database.BatchableContext bc){
    // execute any post-processing operations
}

}