Users are allowed to view all data within our Org, with one exception. Users in Region X are not allow to view leads from other regions but then can view any leads within their region. How do I set this up?


  • You could probably use role hierarchy for this.
    – Luke Vang
    Commented Jan 30, 2015 at 21:36
  • 1
    And org-wide defaults, and sharing rules - but definitely not profiles or permission sets ...
    – user735
    Commented Jan 30, 2015 at 21:39
  • Thank you Luke and John. This is my plan after reading your proposals. Set the OWD on Lead object to Public/RW and enforce role hierarchy. Then put Region X under the rest of the All Regions (Excluding Region X) in the role hierarchy setup. Do you think this will works? Thanks
    – user7123
    Commented Jan 30, 2015 at 21:59

1 Answer 1


In response to your comment:

No. As you go along the different levels of security you can only widen access, you cannot restrict it. OWD is the first level, if you have Lead as public/rw at that level everyone can rw Leads regardless of role hierarchy or anything else.

Set the OWD to be private and go from there.

  • As @Force Hero suggested, I set OWD to private, created two groups and added sharing rules. It works like a charm.
    – user7123
    Commented Mar 2, 2015 at 23:51
  • I've found this very small and quick article helpful in understanding some gotchas regarding role hierarchy, profiles, permission sets, sharing rules, etc. opfocus.com/…
    – Bahman.A
    Commented Feb 6, 2021 at 1:01
  • And also this one which is a bit larger but very comprehensive and clear eltoroit.herokuapp.com/…
    – Bahman.A
    Commented Feb 6, 2021 at 1:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .