Tutorial: Salesforce Sharing Settings are honored in Gainsight

Record-level sharing settings configured in Salesforce are honored by the Gainsight application (with the exceptions noted below under Limitations). No changes are made automatically. Your Salesforce Admin must set the permissions in Salesforce to control which users can see which records based on object permissions, profile setting, role hierarchy and shared settings.

In Gainsight, on the Administration > Salesforce Data Permissions page, simply turn on or off the option to honor Salesforce permissions in 5 areas of the product where users can view reports.

The Gainsight modules and report sections for which you can provide permissions:

• Gainsight Home page
• C360 and R360 Related List sections
• Customers tab
• Engagement tab
• Widgets (Gainsight widget displayed on SFDC Account or Opportunity page)
• While creating or deleting relationship types. 

Notes: 

• You can select any Gainsight feature checkbox(es) in the Respect SFDC Sharing Settings in (Beta) section at Administration > Salesforce Data Permissions to restrict the logged-in user from viewing/exporting records on SFDC objects that they do not have access to. These settings do not apply to MDA data.

Gainsight Home page and Success Snapshot will run in the context of the users who authorized MDA (typically Admins) and not in the context of the user receiving the export.

• Admins can disable all end users from exporting reports both in PPT and Excel/CSV formats from Dashboard, C360, and R360 pages. In the SFDC Sharing Settings page, select the Disable Export of reports on Gainsight Home and 360 pages checkbox.

Note: The Admin can still email Dashboards as PPTs from the Dashboard Builder and for Success Snapshot, both Admin and CSM can still export reports from C360.

 

This tutorial demonstrates how Salesforce’s existing sharing settings can now be honored in Gainsight. Admins can select an individual object in the org and share it with other users. Salesforce provides organization-level sharing settings to set the baseline access for the records, so that you can set the sharing separately for every object. If you want to restrict your users’ access to data of an object, set the object’s Default Internal Access or Default External Access setting as private. This ensures that the records created by you are visible only to you (record owners), and those above your role in the hierarchies. If required, you can extend access to other users by manually sharing the records. Salesforce sharing settings can be accessed at [Click on user profile] > Setup > Administration Setup > Sharing Settings.

For the purposes of this tutorial, two users are created in the organization:

• System Admin 1: Higher in the role hierarchy and hence has full access.
• East CSM: Lower in the role hierarchy and hence has limited access.      

As per the role hierarchy, System Admin 1 can view all of the records created by East CSM. East CSM cannot view the records created by System Admin 1.

The following procedure provides you the step-by-step instruction on how an Admin can limit Account records sharing for an end user. Also, we will review how System Admin 1 can manually share records with East CSM.

1. Navigate to Profile > Setup > Sharing Settings.
2. Click Edit.
3. Set the appropriate object as Private. In the following image, the Account, Contract and Asset objects are set as Private. This means that the Account records created by the System Admin 1 will not be visible to East CSM. Basic access will be present for the East CSM to read, create, edit, and delete records that are lower in the hierarchy, but East CSM will not be able to access/modify all the records that are above its hierarchy in the org.

4. In Gainsight, navigate to Administration > Salesforce Data Permissions and select the modules where you want the sharing settings to be honored. In the following image, Home Page and Customers are selected.