5. Security and Access

A user license determines the maximum feature access that a user can have within Salesforce. You need one to log in.

A Salesforce License offers the most access: standard features and custom objects. It's the most powerful.

It grants access to custom objects/applications, Account and Contact objects, reports, dashboards, but not most standard apps or objects.

User licenses limit access potential, but actual access is granted by profiles and permission sets.

Feature licenses grant access to specific features (e.g., Flow, Marketing) directly, bypassing license limitations.

Permission set licenses give access to add-on products (e.g., Field Service, Analytics), but require associated permission sets for actual use.

Feature licenses enable direct access, while permission set licenses require associated permission sets for users to actually use the features.

Companies are encouraged to use the most basic license that fits an employee's requirements to save costs.

Determines the maximum feature access a user can have in Salesforce.

Default sharing rules set at an organizational level, determining initial access to records.

A hierarchical structure organizing users into a tree-like structure, allowing access to inherit from superiors.

A collection of users designed to grant record access through sharing tools, avoiding individual user assignments.

Conditional rules that grant record access based on ownership or field criteria, extending access beyond OWDs.

Allows users with full record access to manually share records with other users, providing flexibility for one-off access.

Filters that override existing record-level security by removing access to records that don't meet specified criteria.

Permissions created to control access to customizations or specific operations not controlled by standard permissions.

Groups of users who can take ownership of a record, distributing workload and ensuring shared access.

The process of configuring user permissions to restrict access to specific objects or records within Salesforce.

Determines the level of access users have to objects and data based on their roles and permissions.

The principle that roles in a hierarchy inherit access from their subordinates.

Control access to specific data within an object

Used to define the level of access granted to users based on their roles and responsibilities.

A collection of permissions and settings that can be assigned to users to extend their capabilities.

Profiles are the foundation of permissions in Salesforce, determining what features a user can access and what actions they can perform. Each user must have exactly one profile.

Permission sets grant additional permissions to users beyond their profile, allowing them to access more features and perform additional actions.

Standard profiles have limited customization options and custom profiles should be created by cloning and customizing existing profiles.

Assign one profile to all users with the same job function and use permission sets for exceptions to provide tailored access.

Permissions set through profiles cannot be revoked by other methods, making them the most foundational level of permissions.

Permission sets can be grouped together to provide a bundle of permissions for specific tasks or roles.

Permission sets can only add permissions, they cannot remove permissions from a user's profile.

Muting permission sets within a permission set group disables those permissions, providing flexibility in granting temporary access.

Org level security controls access to a Salesforce org through login restrictions, such as password policies and multi-factor authentication.

Password policies ensure strong passwords by enforcing length, complexity, and reset frequency, enhancing security.

Login hours restrict login times to specific periods, limiting access to the org during non-business hours.

Login IP ranges limit logins to specific IP addresses, enhancing security by preventing access from unauthorized locations.

Object level security controls access to standard and custom objects, determining what actions users can perform on those objects.

Record level security determines which specific records a user can access and what actions they can perform on those records.

Organization Wide Defaults (OWDs) define the baseline access level for records across the org, providing the most restrictive layer of sharing control.

This allows users in the hierarchy to inherit the access permissions of their subordinates. However, it only flows upwards, not sideways or downwards.

They are collections of users that grant access to records using sharing rules or manually. They simplify granting access to groups of users.

They grant access based on who owns a record. They can grant read or read/write access to records.

They grant access based on the values of record fields. They can grant read or read/write access when values match the set criteria.

Allows individual users with full access to grant read or read/edit permission to other users on a specific record.

They help control user access to customizations and specific operations, enabling more tailored and granular access control.

It grants direct access to a feature like Marketing or Knowledge, while a _____________ licenses expands possible permissions but requires granting specific access through a permission set.

They are the fundamental group of permissions for each user. Users have exactly one profile, while permission sets are used to provide additional permissions.

Determines the actions a user can perform on accessible records, like creating, editing, or deleting.

It regulates user access to specific fields, allowing or denying visibility and edit capabilities.

It protects sensitive business data from unauthorized access by controlling access and authentication.

It's a security measure that requires at least two verification factors from users.

It allows a group of users to take ownership of a record, helping distribute workloads.

A filter that removes a user's access to records that don't match the given criteria, regardless of whether they would otherwise have access.

A collection of users created to simplify record sharing using sharing rules and manual sharing.

A condition that grants record access to specified users based on the record owner or specific field values.

The representation of a company's organizational hierarchy in Salesforce, used for propagating record access.

It allows users with full access to a record to grant other users access on a case-by-case basis.

Sets of IP addresses that users can log in from using unrecognized devices without needing to provide additional verification.

It's essential for login and sets the boundaries for profiles and permission sets, effectively controlling their maximum capability within Salesforce.