0

A company has 2 franchises, both of which are a part of the same Salesforce org. The CEO manages both franchises, and should be able to see and communicate with all users. The CEO further needs to ensure other users can only see users from their own franchise. Please provide a comprehensive solution that meets all the above requirements.

  • I think you may need to use two separate orgs if you need to hide the users from other users and allow some user to see other user. You scope is not clear so that is about all that can be said at this point.....What to you mean by "see' and "communicate" are you talking chatter? If that is the extent then someone may have an answer for you – Eric Dec 4 '14 at 5:56
  • We have only one org and two franchises. "see" means He can see user records,"Communicate" means he can perform some opertaions on users record. – Ramashanker Tripathi Dec 4 '14 at 6:01
  • I agree with Eric, people with "Manage User" permission will be able to see and manage all Users. you can apply any sharing setting over there. So best is you need to have 2 separate org. Else you can specifically identify Admins (a handful) that have manage user permission and that can EDIT all the users details. – Amit Bangad Dec 4 '14 at 6:24
  • There are successful implementations of this, including one of salesforce's most senior clients, Merrill Lynch, which has 25,000 total licenses (last I heard), with small branches of about 5-10 people (a single office worth of financial advisors) where all data is completely isolated from every other branch-- they are effectively running thousands of orgs within a single combined instance. I've also heard of smaller projects, but the names escape me, of companies that have successfully pulled off the one physical org, two virtual org look. – sfdcfox Dec 4 '14 at 8:22
0

This is perfectly possible with at least Enterprise Edition. You'll want to start by setting all sharing settings to private. Then, fashion your role hierarchy so that the CEO is at top, with two branches, one for each organization; assign the appropriate users to the right roles. Create some sharing rules so that each branch has the necessary access to related records. Configure user sharing so that a user in a particular branch can only see other members in their branch.

Setup delegated admins that can reset passwords, etc, for users they can see. No user should have Modify All Data or View All Data, but instead be set to the top level role for the appropriate branch for sharing purposes (use the Hierarchy Sharing feature of the organization wide defaults). At this point, all that's left is to build out page layouts and profiles for the appropriate groups on each side. A properly configured org will appear as two distinct orgs to users that are not the CEO (e.g. they will only see their own data), but will appear as a merged view of both orgs to the CEO.

This type of setup is non-trivial and requires careful planning. If you have any doubts, try contacting a consultant, or engage technical support. They can help with the most basic questions on how to set this up correctly. As noted in comments, users with System Administrator profiles will have full access to all data. Usually this is one or a few limited number of users that are mutually exclusive to either org (in other words, they are isolated from employees of both orgs so that data won't leak), and are trusted not to take advantage of the data in either org. It's also possible to lock down System Administrator users so they can only login from certain locations, or at certain times, to reduce the risk of data loss/theft/corruption/etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.