Keep Your Organization In Line With These 7 User Profile Permissions
When it comes to keeping your Salesforce Organization safe and secure, there are many areas one could focus on, and it’s easy to get confused by where certain access points are adjusted. You have Organization-Wide Defaults (OWD), Sharing Rules, and Permission Sets and Profiles. Let’s focus on the latter for this article.
Controlling a User’s object based permissions is done on the Profile, or by assigning the user a permission set. But, oftentimes, other object or system specific permissions are overlooked, as they’re buried in the long list of checkboxes and record type assignments you find on the Profile edit page. This can be especially harmful if you’ve cloned a profile or permission set in the effort to create a new one, and bring over permissions that you may not have noticed, or just didn’t know to look for. It’s easy to do! And due to the depth of Salesforce features, as you test out your new profile or permission set, you more than likely haven’t thought of testing for these small pieces of functionality. Many of these system permissions can have huge repercussions if used incorrectly, but it can be rather overwhelming to digest them all.
Keep in mind that the permissions you’ve assigned may need to be considered when Customer privacy and security issues surface, such as in your plan to address GDPR concerns, for example. You need to make sure you understand the full picture of what your users can not only access, but how they can interact with that data. It sounds scary – and it is to be taken seriously – however, you’re taking a great first step into taking responsibility for learning how to make your org better.
Understanding Basic User Profile Permissions
We’ve created a short list of small – but mighty – permissions for you to consider as you approach clean-up or creation of profiles and permission sets. Here is our list of User Profile Permissions Every Admin Should Know!
- Data Permissions – When it comes to data permissions, there are two very simple to remember, but very impactful checkboxes: View All Data & Modify All Data. This is not to be confused with “View All” and “Modify All” on the objects themselves. View All Data and Modify All Data are useful for System Admins who are responsible for data cleansing, mass deletion, and other tasks that require full access. View All and Modify All are best used just for that one particular object, such as an Account Record, or Lead Record. Even so, those should be assigned out rarely, as well, since more than likely none of your end users need to see data for records that do not pertain to them.
- Limit Your Change Sets to Yourself – While it may be tempting to allow your Services Director to assemble their own change sets, this can be a little risky. You especially do not want to give out permissions for users other than Salesforce Admins or Developers to deploy change sets. Remember, most end users do not understand the rigorous testing that should be done (such as test code coverage) before releasing changes to production. They often have tunnel vision, as well, when it comes to what those changes may indirectly affect. You have the keys to the kingdom, and it’s best to keep it that way. Make sure you’ve locked down Deploy Change Sets, Create and Upload Change Sets, and Modify Metadata Through Metadata API Functions.
- Keep your Data In-House – We cannot stress enough the importance of keeping Export Reports limited to System Admins, or your data cleansing team only. If you think a disgruntled employee won’t go as far as exporting a report of all of their contact information or sales metrics and run off into the night, think again. Sure you can get into a legal battle, but the information is gone. Try explaining that when it comes to guaranteeing your Consumer privacy under legislation. It doesn’t even have to be malicious – an exported report as a .csv can be printed, lost, or hacked at no fault of your employee. No matter how much end users beg, come up with another solution before allowing others to Export Reports.
- Make Customer Privacy a Priority – We’ve spoken already on View Encrypted Data, but this a big one. Make sure that only limited individuals have access with this, as it can open up Credit Card information, Social Security Numbers, or other confidential data.
- Protect Your Analytics – There are many situations in which Managers (or higher) need access to reporting that should not be visible to other employees. This could be employee performance, company revenue numbers, or other sensitive information used for analytics and making important decisions. You want to make sure users do not have Manage All Private Reports and Dashboards or View Reports in Public Folders. This would allow users to not only access those hidden reports, but also make changes to them accidentally. Keep your metrics consistent, and safe, by keeping these to System Admins only.
- True System of Record – Contracts in Salesforce are often the System of Record for indicating which customers are active and should be receiving services or goods. Except for your team that handles those contracts after processing payment and considering a whole host of legal checks before activating, no one else should have permissions to mistakenly Activate Contracts or Delete Activated Contracts. Even if the customer never renews their contract, you’ll want to keep that information stored to show historical data.
- Lock Down Cases – Although not as serious as the others, but you want to be considerate of who has Manage Cases permissions. This would allow users to re-assign cases to other users (even mass-transfer) and adjust Case settings, such as Email-to-Case. You may want to give this permission to Support Management, but make sure every user doesn’t have the ability to make such changes. Keep in mind that this could affect customers based on Communities, or other portals you may have set up.
This is a lot to absorb, however, each of these can play an important role in the security of your org. If you need help tackling clean-up, make a cheat sheet of the permissions we’ve discussed, and start with your end user profiles first, working your way towards management. Get organized the way that works the best for you, and take it one profile at a time!