Salesforce: Reason for Access in Sharing

In an old blog written many years back, you can check the reason for access of a record to a user using the Sharing button. There is a slight difference in information given in Classic compared to Lightning.

Classic:
https://domain.my.salesforce.com/setup/own/entitywhylist.jsp?id=0060o00001TvlTM&uid=00590000000Ougm

Lightning:

https://domain.lightning.force.com/lightning/r/Opportunity/0060o00001TvlTMAAZ/recordShareHierarchy?userId=00590000000OugmAAC

Classic does not tell you which sharing rule, but only "Shared With". Lightning does better with the Rule Name, but in the above sample, the rule name is not very helpful "This_is_Test".

The Sharing Rule

Let's look at the sharing rule; for the below example, since there's only one sharing rule with "Shared With" to a specific group, we can identify the sharing rule quickly, but if there are many, we need to click edit to each rule to see the rule name. 

The rule name will only be visible when clicking the "Edit" link.

Is there an easy way to find the rule? 

Yes, you can download the metadata, e.g., using Salesforce Inspector or Workbench. 

    <sharingCriteriaRules>

        <fullName>This_is_Test</fullName>

        <accessLevel>Read</accessLevel>

        <label>This is Test</label>

        <sharedTo>

            <group>Group_Staff_2B</group>

        </sharedTo>

        <criteriaItems>

            <field>FieldName</field>

            <operation>notEqual</operation>

            <value>CH1,SG1</value>

        </criteriaItems>

        <includeRecordsOwnedByAll>true</includeRecordsOwnedByAll>

    </sharingCriteriaRules>

Sharing Rule by Criteria

Text and Text Area are case-sensitive. For example, a criteria-based sharing rule that specifies “Manager” in a text field doesn’t share records that have “manager” in the field. To create a rule with several common cases of a word, enter each value separated by a comma.

Example from below screenshot: Account Name containing AAA will be shared with Group Staff 1, but not for Account Name containing aaa. 

You can use the following field type for sharing by criteria:

• Text
• Text Area
• Picklist
• Checkbox
• Number
• Percent
• Fax
• Phone
• URL
• Date
• Date/Time
• Email

But, not the following field type:

• Lookup
• Formula
• Currency
• Long Text Area
• Rich Text Area
• Picklist (Multi-Select)
• Roll-Up Summary

Reference:

• Salesforce: Sharing Button URL
• Retrieving sharing rules using the metadata API
• Sharing Rule Types

Salesforce: Sharing Rule with Text field

Here is the requirement: share Opportunities with a public group if the Countries (a text field) are not Japan or Singapore.

This should be easy to achieve with the Opportunity Sharing Rule "based on criteria".

From the above screenshot, the criteria look okay, but it will not work, because the field here (Countries) is a text field, it will work only for a Picklist field. 

Note: Multiselect Picklist field is not available in the sharing rule "based on criteria".

Tweak the above criteria to the following and it should work now.

Salesforce: Controlling Record Access (Contact, Opportunity, Case)

In the previous blog, we discussed sharing record with sharing rules using Public Group & Role. In this blog, we will discuss the additional options to share records based on the object types.

Grant Access Using Hierarchies

In the Organization-Wide Defaults, we can see if Grant Access Using Hierarchies is enabled for each object. For Standard objects, this is enabled by default and cannot be disabled, while for custom objects, admin can enable/disable "Grant Access Using Hierarchies" for each object.

If Grant Access Using Hierarchies is enabled, users in the above role hierarchy will be able to access or edit the records (depend on the profile permission too).

sample: Maria Ann able to access the record, because she is assigned with the higher role hierarchy of the record owner Free Man

While if Grant Access Using Hierarchies is disabled, users in the above role hierarchy will not able to access the records of that object, unless it shared using other methods, such as sharing rules, or etc.

Access to Contact, Opportunity, and Case from Sharing Rule

Contact, Opportunity, and Case are standard objects for Sales/Service Cloud, but these 3 objects are special and different from other standard Salesforce objects, they are linked directly to Account, and admin able to configure access to records in these 3 objects based on the Account ownership.

When you create a sharing rule for Account, you will able to set Contact, Opportunity, and Case access too, so you can define Contact, Opportunity, and Case access from Account Sharing Rule.

Access to Contact, Opportunity, and Case from User Role

Each user ideally assigned with a role. In the role setting, there is an additional access setting for Contact, Opportunity, and Case. 

As the above screenshot, from Role setting in the role hierarchy, user may be able to view or edit Contact, Opportunity, and Case if the user owns the Account. This also includes users in the above role hierarchy of the record owner.

Salesforce: Account accessibility

As we mentioned in this blog Contact, Opportunity, Case access, Role Hierarchy play a part in giving Account owner accessibility (view or edit) of Contact, Opportunity, and Case tagged to the Accounts owned by the user.

However, how is the other way round, if the Opportunity (including Contact and Case) is not the same with the Account owner, can the Opportunity owner able to access Account where the user supposed not able to access that account?

The answer is yes, this is called implicit sharing. Salesforce provides implicit sharing between accounts and child records (opportunities, cases, and contacts), and for various groups of portal users.

• Access to a parent account — If you have access to an account’s child record, you have implicit Read Only access to that account.
• Access to child records — If you have access to a parent account, you have access to the associated child records. The account owner's role determines the level of access to child records, read this blog Contact, Opportunity, Case access.

However, this does not apply to lookup relationship for custom objects.

If you are still in Classic, you can check the sharing reason, read this blog Sharing Button URL. This implicit sharing will be shown with reason as "Associated record owner or sharing", if you click that link, it will show which records that associated and give the user access to the parent record.

Click "Associated record owner or sharing" link, in this sample, I click "Allison Wheeler".

Reference:

• Contact, Opportunity, Case access
• Sharing Button URL
• Built-in Sharing Behavior
• Implicit Sharing