[SalesForce] Default Customer Community Plus Roles expose all Account’s

I would like all Account's to be private, however users can see any Account enabled with Customer Community if that Account Owner is in the same Role as them.

Using "Account Access", by clicking on "Why?", I can see that the Customer's role created automatically had the "Reports To" field set as the same Role of the Account owner. Therefore, anyone in the same role as the Account Owner would see that person's Account's through Role hierarchy.

The OWD for Account sharing is set to private, the organization only has a single Role configured for all users, and Account Teams are used for individual sharing.

For context: we will probably enable Account Role Optimization, however in testing that doesn't solve this issue, since the "Reports to" for the Person Role behaved the same way in testing.

I need to prevent exposing customer Accounts to people in the same Role as the Account owner, when those Account's are enabled with customer community.

Best Answer

External Roles (PC or CC+) exist in the role hierarchy under their respective Account Owner's Role, although you cannot see them when you view the role hierarchy.

Sounds like your sharing model is:

  • Account = Private
  • Role Hierarchy = ONE role for all internal users.

Thus, all of your Customer and Partner Roles exist under this single role. This means that all internal Users can see Customer and Partner Accounts.

Sounds like you don't want this.

Try this:

  1. Create another leaf on your "flat" role hierarchy. The second role would not report to the first role, it would be a peer.
  2. All of your external Account's should be owned by individuals in this second role. Mind ownership skew...
  3. In this way, only the internal Users assigned to this new role would be able to see all Customer and Partner Accounts. For internal Users in the other role, they won't have visibility unless you grant it to them using tools you are familiar with like sharing rules, manual sharing, territory mgmt, etc.
  4. Adjust your sharing model for internal... while you may have solved visibility issues you were experiencing with external data, now your internal record visibility will need to be revisited in light of this additional role.
Related Topic