2

We have about 108 users in out application who need to be able to have read / write access on an special sObject and do other lots of things.

There are two user who need to do the same other lots of things as other 108 users but to whom we do not want to provide write access to that special object.

All these users have same profile since they need to do most of the same things.

What is the best way to provide only read access to these two users while provide read / write to others on sObject.

Improve this question

2 Answers 2

Reset to default
4

Permission sets are one way but are messy when it comes to maintaining them in the future. Other way you could achieve is to clone the current profile and then add or remove the various permission on the profile and label it appropriately so you know in the future and assign the profile to the two users.

Another option is to not change any profile and to use role or public groups and assign only read access to the record using sharing rules. Assign the newly created roles to the two users or assign them in the public group.

UPDATE

Looking at this video will give you a better understanding. Basically what you are after is to have the Org-Wide Sharing Defaults for the sObject to be private and you have to create two sharing rules. So for example you have role X and role Y, and everything created by role X you give read/write access to role X and with the other rule everything created by role X you give only read access to role Y. It will be the same scenario if you go with a public group but this is useful if you have a flat structure in your organisation rather than a hierarchical one.

Hope it makes sense if not I`m happy to explain more.

Improve this answer
2
  • can you please explain the solution using sharing rules with more detail ?
    – Walker
    Commented Dec 20, 2014 at 4:08
  • I`ve updated my answer with how you could achieve this using sharing rules.
    – Mihai Neagoe
    Commented Dec 20, 2014 at 11:17
2

Best way is give Read access to the profile. Create a permission set which will have Write access to the object. Attach the permission set to the user profile who need the write access.

More you can get from the following link: https://help.salesforce.com/HTViewHelpDoc?id=perm_sets_overview.htm&language=en_US

Improve this answer
2
  • 3
    A permission set is less desirable in this case, because you're subtracting a permission for one user, not adding a single permission. This would require adding a permission set to 107 users in order to restrict one user.
    – sfdcfox ♦
    Commented Dec 19, 2014 at 17:50
  • is using sharing rule the right thing to do here ?
    – Walker
    Commented Dec 20, 2014 at 4:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .