Role Hierarchy in Salesforce

In today’s fast-paced business environment, managing data access and security within Salesforce is crucial for maintaining operational efficiency and safeguarding sensitive information. 

This blog delves into the intricacies of Role Hierarchies and Manager Groups in Salesforce, offering insights into how these features can be leveraged to optimize data access and sharing. By understanding and implementing these structures, organizations can enhance their data management strategies and ensure that the right individuals have the appropriate level of access to critical data.

From this blog, you will gain:

• An understanding of Role Hierarchies and how they facilitate access to records based on the organizational hierarchy.
• Insights into Key Features of role-based access, including view, edit, and report permissions.
• Knowledge on Grant Access Using Hierarchies and its impact on data accessibility within custom objects.
• A guide to Manager Groups for manual record sharing with direct and indirect managers or subordinates.
• Implementation Considerations for effectively setting up and managing Role Hierarchies and Manager Groups.

Let’s get started!

Role Hierarchy

Role Hierarchies give access to users higher in the hierarchy to all records owned by users below them in the hierarchy. Each role in the hierarchy represents the level of data access that users in that role should have. Thus, the role hierarchy may not match a company’s org chart.

Key Features

• Users at any given role level have a view, edit, and report access to data owned by or shared with users below them in the role hierarchy.
• Users on the same role do not have a view or edit access to data records owned by each other.
• Contact Access – A role can allow users to view, edit or have no access to the contacts associated with the Accounts that the user owns.
• Opportunity Access – A role can allow users to view, edit or have no access to the opportunities associated with the Accounts that the user owns.
• Cases Access – A role can allow users to have a view, edit or no access to the cases associated with the Accounts that the user owns.

Grant Access Using Hierarchies

This option is available in the Organization-Wide Defaults related list. When disabled for a custom object, only the record owner and users granted access by the org-wide defaults receive access to the object’s records. Users in the upward hierarchy do not get record access of their subordinates by default.

Manager Groups

Administrators can enable Manager Groups to allow users to manually share records with their direct and indirect managers or their direct and indirect subordinates. It allows users to share records with their management chain instead of sharing records with all managers in the same role based on the hierarchy. These groups can also be leveraged while configuring sharing rules.

Every user has two manager groups-Managers Group and Manager Subordinates Group – where Managers Group includes a user’s direct an indirect managers, and Manager Subordinates Group includes a user and the user’s direct and indirect reports. These groups are available on the Share with dropdown list on the Sharing Rule Setup page.

Implementation Considerations for Role Hierarchy

Key Considerations

• Users can gain access to records they don’t own through other means apart from role hierarchies such as profile settings, sharing rules, or manual sharing of individual records.
• Users with the View All and Modify All object permissions get record level access even if Grant Access Using Hierarchies is deselected.
• Activities associated with a custom object for which the Grant Access Using Hierarchies option is disabled are still visible to users in the upward hierarchy.
• The default access on a custom object on the detail side of a master-detail relationship is reverted to Public Read/Write, and Grant Access Using Hierarchies is selected if the relationship is deleted.
• Users’ record access granted via sharing sets isn’t extended to their superiors in the role hierarchy.

Use Case

The ASM of a company wants to share records of custom Sales Target objects with his sales reps. The Sales Achievements records of each sales rep should be shared with the user’s management chain. Sharing setting for both these custom objects is set to Private, and Grant Access Using Hierarchies is disabled. Which feature can the administrator leverage meet this requirement?

Solution: Use Manager Groups

Reason: The administrator can enable Manager Groups so that the ASMs can share Sales Target records with their Manager Subordinate groups, and the sales reps can share the Sales Achievement records with their Manager Group.

Summing Up

In conclusion, mastering Salesforce’s Role Hierarchies and Manager Groups is essential for any organization looking to streamline its data access and enhance security protocols. By leveraging these powerful features, you can ensure that your team has the right access at the right time, fostering a more efficient and secure working environment. Remember, the key to unlocking the full potential of Salesforce lies in understanding and applying its complex data sharing and security mechanisms effectively.

Ready to elevate your Salesforce expertise? Dive into a world of learning with saasguru. Sign up today and start your free trial to gain access to over 18 Salesforce Certification Courses, 50+ Mock Exams, and 50+ Salesforce Labs for hands-on learning. 

Embark on your journey to Salesforce mastery with saasguru and transform your career with the skills that matter.

Frequently Asked Questions (FAQs)

1. What is the difference between list and hierarchy custom settings in Salesforce?

In Salesforce, custom settings come in two types: List and Hierarchy. List custom settings are similar to custom objects and enable application developers to create a set of static data that can be accessed across the organization. On the other hand, Hierarchy custom settings allow for the creation of data that varies with the profile or specific user. The key difference lies in how the data is accessed and utilized: List settings are organization-wide, whereas Hierarchy settings leverage the ‘salesforce hierarchy’ to provide different values to different users or profiles, thus offering a more granular level of access control and customization.

2. How do you enable the role hierarchy in Salesforce?

To enable the role hierarchy in Salesforce, follow these steps:

1. Navigate to Setup and enter ‘Roles’ in the Quick Find box, then select ‘Roles’.
2. From here, you can either modify an existing role hierarchy or create a new one by clicking ‘New Role’.
3. Define the role, ensuring it aligns with your organization’s ‘salesforce hierarchy’, and specify the users within each role level.
4. Remember, enabling and configuring the role hierarchy allows you to control data access through the organization based on the roles within the Salesforce hierarchy.

3. How do you view the hierarchy in Salesforce?

Viewing the hierarchy in Salesforce, particularly the role hierarchy, is straightforward:

1. Go to Setup and enter ‘Roles’ in the Quick Find box, then click ‘Roles’.
2. On the Roles page, you will see a diagram or list view of the current ‘salesforce hierarchy’.
3. Click on a specific role to view its position within the hierarchy and see detailed information, including users in the role and subordinate roles. This view helps administrators and users understand the structure of data access and reporting lines within their Salesforce organization.