Welcome to Object Access, the third in the
Who Sees What series. These videos provide the basics on visibility and data access in
Salesforce. OK, so you’ve given users access to the
organization by setting IP ranges, and login hours.
Now it’s time to talk about access to objects. Profiles determine the objects a user can
access, and the permissions a user has on object record.
Profiles also control which which tabs are visible and which apps are available in the
app picker. Profiles also determine object access and
what permissions users have to each object: Create, Read, Edit, and Delete.
As we saw in the earlier video, “Organization Access”, the profile also contains System
Settings that control login hours and IP ranges. Salesforce provides standard profiles to get
you started. These profiles may not be edited, but they can be cloned, and then edited to
create custom profiles. The most basic profile is the Standard User.
The Standard User has Create, Read, Edit and Delete permissions to most standard Salesforce
objects, such as accounts, contacts and opportunities. There are three additional profiles, that
are based on the Standard User. These profiles build on the standard user
profile, with additional permissions for users in specific areas.
There are two other special profiles: The Read Only profile, which grants access
to the same objects as the Standard User profile, but limits permissions to Read Only
And the system administrator profile. The system administrator profile has 2 super powers:
View All Data and Modify All Data. These permissions override all sharing rules and settings, so
use caution when granting these permissions to any other profiles besides the System Administrator.
Let’s go to our practice organization for AW Computing to see how to this works. In this demo we’re going to create a custom
profile for the Inside Sales Reps at AW Computing. First we’ll enable the enhanced profile
user interface. This new interface makes navigation when creating profiles much easier. This setting is located under Customize | User
Interface. Lets use the Quick Find box to locate Profiles.
Here we see a list of all the standard and custom profiles in our org.
We’ll clone the Standard User profile to get started,
And name it. The profile interface is divided into 2 sections:
Apps settings and System settings. App settings determine what apps are available
to the user, which objects and tabs they have access to, and app specific permissions, such
as “Manage Call Centers” for the call center app. System settings determine login hours and
IP ranges for a particular profile, and determine system permissions. System permissions work
across the entire app. They range from permissions like “Create and Customize Reports” to
“Edit Read Only Fields.” We’ll start with Assigned Apps
Our Inside Sales Reps don’t need access to the Call Center or Marketing apps, so we’ll
deselect those. And we’ll keep Sales as the default app.
Next we’ll set the permissions this profile has to Objects.
This drop down arrow gives us access to both the App and the System settings, just as we
saw on the previous page. We’ll click Object Settings. We don’t want Inside Sales to edit or delete
accounts. That process managed by our Marketing team, so we’ll clear the checkboxes.
From the Object picklist we’ll go to Contacts. We’ll leave these settings as is. Since
the Inside Sales people are in touch with their clients we want them to be updating
their contact records. From the Object picklist we’ll go to Opportunities. We don’t want Inside Sales people to delete
opportunities. If an opportunity is lost, we want to keep that record in the system
so the Sales team can evaluate its wins and losses. AW Computing uses Chatter Files and Content
for all document storage, so we don’t want the Sales people to mistakenly use the Documents
object. We could just mark this tab as hidden, but…
users might still see records of this type, in reports, dashboards, or in related lists.
Since our goal is to prevent access to this object entirely, then we’ll remove the Read
permission from the Object permissions. We’ve just created a custom profile, based
on the Standard Profile that was provided by Salesforce.
Now we’ll assign this profile to Karen Adams, one of our Inside Sales people. We’ll also assign this profile to everyone
else in inside sales. We can see which users are assigned to a profile by going to the
profile list, clicking the profile in question, and viewing the list of assigned users
Great – we’ve just created a custom profile for our salespeople and assigned it to everyone
on the sales team!