salesforce_security_impl_guide

Securing and Sharing Data
“View All” and “Modify All” Permissions Overview
“View All” and “Modify All” Permissions Overview
The “View All” and “Modify All” permissions ignore sharing rules and settings, allowing administrators
to quickly grant access to records associated with a given object across the organization. “View All”
and “Modify All” may be preferable alternatives to the “View All Data” and “Modify All Data”
permissions. Be aware of the following distinctions between the permission types.
EDITIONS
Available in all editions
Permissions
View All
Modify All
View All Data
Modify All Data
View All Users
Used for
Delegation of object permissions
Managing all data in an organization;
for example, data cleansing,
deduplication, mass deletion, mass
transferring, and managing record
approvals
Viewing all users in the organization.
This permission grants you Read
access to all users, so that you can see
their user record details, see them in
searches, list views, and so on.
Users who Need them
Delegated administrators who need
to manage records for specific objects
Administrators of an entire
organization
Users who need to view all users in
the organization, especially if the
organization-wide default for the user
object is Private. Administrators with
the “Manage Users” permission are
automatically granted the “View All
Users” permission.
“View All” and “Modify All” are not available for ideas, price books, article types, and products.
“View All” and “Modify All” allow for delegation of object permissions only. To delegate user administration and custom object
administration duties, define delegated administrators.
“View All Users” is available if your organization has User Sharing, which controls user visibility in the organization. To learn about User
Sharing, see User Sharing Overview.
Comparing Security Models
Salesforce user security is an intersection of sharing, and user and object permissions. In some cases,
such as in end-user record level access, it is advantageous to use sharing to provide access to records.
In other cases, such as when delegating record administration tasks like transferring records, cleansing
data, deduplicating records, mass deleting records, and delegating workflow approval processes,
it is advantageous to override sharing and use permissions to provide access to records.
The “Read,” “Create,” “Edit,” and “Delete” permissions respect sharing settings, which control access
to data at the record level. The “View All” and “Modify All” permissions override sharing settings for
specific objects. Additionally, the “View All Data” and “Modify All Data” permissions override sharing
settings for all objects.
The following table describes the differences between the security models.
EDITIONS
Available in:
• Enterprise
• Performance
• Unlimited
• Developer
• Database.com
34