User Management and Data Security

User management is a key activity for a Salesforce administrator. When a new employee joins an organization and needs access to Salesforce, the way that user is created will determine what level of data access is granted to that user.

In this chapter, we will cover the following user management features in relation to data security:

• Creating users
• Understanding record ownership
• Learning how record ownership relates to data security
• Understanding ownership skew

With the help of these topics, you will be able to create a user and learn about the implications of record ownership on data security.

Technical requirements

For this chapter, make sure you log in to your development org and follow along as we work through the creation of users and analyzing record ownership.

11 User Management and Data Security

User management is a key activity for a Salesforce administrator. When a new employee joins an organization and needs access to Salesforce the way that user is created will determine what level of data access is granted to that user.

In this chapter, we will cover the following user management and data security features in detail:

• Creating users
• Understanding record ownership
• Learning how record ownership relates to data security
• Understanding ownership skew

With the help of these topics, you will be able to create a user and learn about the implications of record ownership on data security.

Understanding record ownership

Record ownership is central to the access capabilities built into the Salesforce platform. This ownership allows you to specify which users should be able to access specific records. Every record created in Salesforce has an owner. An owner is a user in the system (such as the user we created in the previous section). At a minimum, the record owner would have access to the record they own. This access can then be expanded to other users using various sharing and visibility features that were covered in Chapter 10, An Overview of Sharing and Visibility. All organizations have some level of independent work, ad hoc collaboration, and structured collaboration. These use cases are all covered by record ownership and sharing features built into the Salesforce platform. Figure 11.5 below shows the record owner field, in this case, Account Owner. The owner field on all objects determines who the owner of the record is.

The only exception to this...

Record ownership and data security

To balance the flexibility for collaboration and the need for data security, Salesforce includes multiple features to restrict access to data. Many of these features were discussed in Chapter 10, An Overview of Sharing and Visibility, but we will summarize a few key features below:

• Organization-wide defaults: When you set an object’s organization-wide default to Private, only the users that own records belonging to that object have access. This can be extended using the various sharing options, profile, and role settings.
• You can configure custom objects to prevent users from automatically inheriting access to them through the role hierarchy.
• You can prevent users from deleting records through profile settings. This may also include record owners.

All of the Salesforce Platform sharing capabilities are supported by three components of the ownership-based sharing architecture:

• An Owner field for all...

Understanding ownership skew

When a single user owns more than 10,000 records of an object, it is called data skew. This is sometimes done when organizations want to park unused data somewhere, or want to assign a dummy user to own many records for a particular object. This practice may cause performance issues if those users are moved around the role hierarchy or if they are moved into or out of a role or group that is the source group for a sharing rule. The reason this is an issue is if a change is made to the sharing of a record, Salesforce must move a large number of entries into the sharing tables, which can take a long time and lock the records in that object. Locking the records would give other users trying to edit these affected records an error if they attempt to work with one of the records during the calculation.

There are a few ways to help remedy this issue:

• Distribute ownership of records access to a greater number of users. This will reduce the number...

Summary

In this chapter, we learned how to create a user in Salesforce. We then discovered what record ownership is and how it relates to data security. We looked at the “under the hood” sharing components of the Salesforce platform and how these components may affect performance if ownership skew occurs. Finally, we learned how we can remedy ownership skew if it does occur.

In the next chapter, we will cover how to manage projects effectively using sandboxes and change sets.

Questions

1. What is the Marketing User checkbox used for when creating a user?
2. Where do you set the time zone for a user?
3. What is the exception to every record having an owner in Salesforce?
4. How do organization-wide defaults help to secure data?
5. What is ownership skew?

Further reading

• The Complete Guide to Salesforce User Management: https://www.salesforce.com/resources/guides/salesforce-user-management-guide/
• Manage Users: https://help.salesforce.com/s/articleView?id=sf.users_mgmt_overview.htm&type=5
• Behind the scenes of record ownership in Salesforce: https://developer.salesforce.com/blogs/engineering/2013/10/behind-the-scenes-of-record-ownership-in-salesforce#:~:text=Record%20ownership%20is%20at%20the,records%20or%20types%20of%20records
• Ownership Data Skew: https://developer.salesforce.com/docs/atlas.en-us.draes.meta/draes/draes_group_membership_data_skew.htm

Join our community on Discord

Join our community’s Discord space for discussions with the authors and other readers: https://packt.link/rlptF