Friday, November 30, 2018

Resolving "Read All Accounts" Permissions Issue with the "old" Profile Editor

Problem / Issue: 

As part of a project to enable Lightning Knowledge for an org, I was tasked with doing some clean-up of various user Profiles in the org. An audit found that the Data Migration profile had access to the Knowledge object, but shouldn't have. When I went to remove these permissions, Salesforce presented an error (see below): I couldn't remove access to the Knowledge object until I first resolve the permission issues on Account Brands and Scorecard Associations.  


No problem -- this Data Migration Profile shouldn't have access to either of those objects either, so I thought I'd just go remove them. The trouble is that if you're using the Enhanced Profile Editor, you can't make permission changes to multiple objects.

For example, as soon as I went to make remove access to the Account Brands object, Salesforce presented an error: I couldn't remove those permissions until I first removed permission from the Scorecard Associations object:


Similarly, if I tried to remove permissions from Scorecard Association, I got an error saying I had to first resolve the access permissions on the Account Brands object.

It took me a few cycles to figure out that the problem here is that unlike the original Profile Editor, the Enhanced Profile Editor doesn't allow you to make changes to 2 or more objects at the same time. Each time you make a permission change to an object, Salesforce will validate the change before allowing you to save the change. But I needed to make changes to two different objects, and the Enhanced Profile Editor wouldn't allow me to do that. 

The Fix

You need to revert back to the old Profile Editor, since it allows permission changes to multiple objects before a Save operation is committed. To revert back to the old profile editor, go to Setup and in the Quick Find type and select "User Management Settings", then disable the "Enhanced Profile List Views" setting. You can come back and enable this setting after you have made the necessary profile permission changes. 

So if you're running into problems with profile editing, keep in mind that the old Profile Editor was kept around for a reason -- there are simply some things you can't do in the new Enhanced Profile Editor mode.