Permissions Sets Coming to a Salesforce Org Near You
Arkus recently had the opportunity to be part of the permission sets pilot program with one of our clients. For those who do not know what that is, Permission Sets enables Administrators to manage profile requests without affecting all users tied to the same profile and without creating one-off profiles. For example, you can create a permission called Edit Contacts and assign it to a user who's profile doesn't allow them to edit Contacts. You can also group these permissions into a Permission Set to create Super User Profiles without actually having to clone and create a brand new profile. I thought it would be a good idea to discuss how we went about applying these permission sets to a very large and complex profile model and give a little feedback on our first impressions.
Current State
Here is a breakdown of this Salesforce org to help paint the picture. There are over 250 users using 27 different profiles with over half of the profiles being used by less then five users. We all know having permission sets that allows you apply individual permissions to a user avoids this level of complexity but how do you go about untangling the knot? Here is a list of steps we went through to solve the issue.
Step 1: Logical Grouping
The first and maybe the most critical step is to review the profiles and logically group them in some way. We were able to do this by line of business. This allows you to set the base of what your new profiles are going to be. Once we established the groups, we pulled all the profile data into excel and broke each one into its own tab. This allowed us to now focus on each grouping but with a consistent format across the board.
Step 2: Identify New Profile Permissions
Next we spent time doing some data analysis across the permissions and settings. Using some excel formulas and functions we identified which permissions were the same across the grouped profiles and which profile had the lowest level of access per profile permission. The permissions that were the same across profiles identified unneeded permission sets and identifying the lowest level of access gave us our new profile setting.
Step 3: Identify New Permission Set Settings
Now that we have our new profile permissions set, we can start laying out what each new permission set will look like. An example is the profile assigned to the user dictated that they only had "Read" access on Contacts but using a permission we were able to assign that specific user "Read/Create/Edit" on Contacts without changing the profile and therefore not changing all the other user's permissions within that base profile. It became a bit manual at this point but by using some excel functions earlier in the process, it became a much easier task to identify what each permission set needed to have.
Step 4: Create and Test
Our process to this point has now given us the data to begin creating these new profiles and permission sets and assigning them to users. We started by creating all the permission sets first. Then we created the new profiles and once that was complete we updated each user with their new setup. Once done, it was on to testing.
Permission Sets; The Good and the Enhancement List
Permission sets are a much needed enhancement to the Force.com platform. As more and more companies expand their usage of Salesforce, the more complex profiles and permissions will get under the current model. This new functionality delivers permission setting at a user level which is a much more efficient way to manage user's access to the system. This first version delivers the basics - here are some of the good things and some things to consider for future enhancements.
The Good
Permission Sets are easily found under the manage users menu right next to profiles and follow the wizard like process we all know and love when creating a new permission set. In addition, they allow you to clone existing permission sets which became very helpful. The layout is pretty standard and they do logically group the settings which I found to be a bonus. Your first level is on the App and System level and then they go even more granular within the App setting with them broken down by things like Call Center, Sales, and Content.
The Enhancement List
As mentioned, this new feature delivers from a functional perspective but it does have a few things worth noted for the next release. For starters, there is no way to add a permission set to multiple users. You must do it from the user page which in the case above, updating 250 users was a long haul. Now I know this is meant for the ability to assign permissions on a user level, but there are many use cases where you will need to assign a permission set to multiple users and if you could search by profile, that would be even better. The other big thing would be to allow for inline editing. It was a very manual process to have to click into which type of permission and then each permission individually. Oh and don't forget to hit save! It definitely requires way too many clicks. Other then these two, the look and feel is pretty good. Its a great start and can't wait to see what they do with it next!
