How To Create Sharing Set In Salesforce

As you may or may not know, Community Cloud, it's my favorite of the Clouds. I know, I know, we aren't supposed to pick favorite children, but of all my cloud children, I love this one the most for good reason. Why you ask? Well, tons of reasons, and it's because a Community works so much differently than regular Salesforce. You are taking your org and exposing things in an entirely different way, sharing your data to your Customers and Partners. You are building your very own 'Ohana', creating a way for your external users to connect with one another.

With the concept of exposing your data externally, you will need to keep in mind security for your data. That is what this mini-series in my blog is all about. We will be reviewing a variety of items specific to Communities that are related to sharing. Let's start with making sure we have our basics down.

Basics

Let's start with our security pyramid, if you don't know this one you should copy this image and save it. It will become your general security BFF. Keep in mind, it is only partially your Communities best friend, it only gets you through the basics.

Image result for salesforce security pyramid

OWD

Your Org Wide Defaults.

These are super important, they are the FOUNDATION of your org and when it comes to the Community Cloud you need to realize there are 2 parts of your Org Wide Defaults (OWD), your internal sharing model and external sharing model. It's the external sharing model that applies to the community users, not the internal.

Role Hierarchy

Roles are a bit funky – trust me here. So this is where licenses come into play for the first time. What I mean by that is depending on the license type determine whether or not you even have a role. So let's break this down first.

Customer Community (CC) – No Role

These users are role-less
This means they can't be added to public groups
This also means that role based sharing won't work since they don't have roles
If you only have Customer Community licenses you won't have the ability to set how many roles your CC users have
No Manual Sharing allowed

Customer Community Plus (CC+) – Roles

Customer Community Plus/Customer Community Plus Login users have Roles
You can set how many roles they have – from 1-3
The roles available are User, Manager, Executive
You cannot change role names
When you set how many roles this is ORG WIDE, not per community or per profile, but PER ORG
These users can be in Public Groups
Manual Sharing Allowed

Partner Community – Roles

Partner Community/Partner Community Login users have Roles
You can set how many roles they have – from 1-3
The roles available are User, Manager, Executive
You cannot change role names
When you set how many roles this is ORG WIDE, not per community or per profile, but PER ORG
These users can be in Public Groups
Manual Sharing Allowed

For CC+ and Partners you set the Number of Roles for your org for each at:

Classic: Setup – Customize – Communities – Community Settings

Lightning: Setup – Feature Settings – Communities – Community Settings

Sharing Rules

Now you may think sharing rules are a great way to share things, I can just make a rule, that says if this is your account I will share it with you. Problem there.. LIMITS! You have only 50 sharing rules per object that you can make. As your community grows and you think about how many accounts you will be using or how many users you will be activating you will quickly, and let me tell you, OH oh, oh, so quickly run out of sharing rules. No need to fear… Sharing sets are here to save the day!!

Sharing Sets

Sharing Sets are an amazing superpower that comes with your Communities. They are a way to share with Community License types and Community users. Keep in mind, this type of security and sharing is only available for your community users, it is not available to share with internal users.

History vs Present

Once upon a time there needed to be a way to share with your Customer Community (CC) users. Since they don't have roles and aren't able to be in Public Groups, they can't have manual sharing. So to do so Salesforce came up with a magical way to share on large volume levels that wouldn't take a huge toll on the system. Sharing Sets. Now, as of recently, this functionality has been expanded to not only be available for Customer Community (CC) but also Customer Community Plus (CC+) and Partner Licenses.

How They Work

Sharing Sets work different than most other sharing you will think about in the Salesforce world, and totally differently than the sharing that you are used to for internal users. Let's break this part down….

You know those global variables that work oh so awesomely in formulas? So here's how it works, Global Variables, match a variable make a formula true. This is very similar to how your Sharing Sets work. Here we go:

You have your User.

The User is always connected to a Contact (or Person Account), that's how you created your community User.
This Contact is the User.ContactId
The Contact also has an Account, the User.Contact.AccountId
You can also use the User.ContactAccount, these are your Account Contact Relationships

Then you have your records. Records can be shared if they have a ContactId or AccountId. What Sharing Sets do is say hey I am this logged in User. My User.Contact.AccountId = x, the AccountId on this record = x, because they match I can see this record.

If the AccountId on the record was y then it would not be visible.

Objects for Sharing Sets

The following objects can be used with sharing sets:

Account
Account sharing sets can control access to Contract, Entitlement, and OrderItem objects
Asset
Campaign
Case
Contact
Custom Objects
Individual
Lead (contact Salesforce Customer Support to enable)
Opportunity
Order
ServiceAppointment
Service Contract
User
Work Order

The Available Objects list excludes:

Objects with an organization-wide sharing setting of Public Read/Write
Custom objects that don't have an account or contact lookup field

Sharing Set Checklist

Your Org Wide Defaults as Private for your External Sharing Model
You know the objects you want to share
You have your Custom Profiles created for your Community Users
Your Custom Profile(s) have the objects with the proper CRUD access

How to Set it Up

First off you need to know that you can only have one Sharing Set per Community Profile. So that means you create the sharing set for the profile and all the objects are within that sharing set. You can only share each object one way. Objects must be Private to show up in the list of objects for Sharing Sets. Sometimes you'll be looking for an object to find out that your OWD has the object as Public Read/Write, switch it to Private to do Sharing Sets on it. You need your data secure.

Go to Setup and Access your Community Settings

Classic: Setup – Customize – Communities – Community Settings – Sharing Sets

Lightning: Setup – Feature Settings – Communities – Community Settings – Sharing Sets

You'll see the 2nd section of the page is Sharing Sets. Unless you have your profiles sharing all objects the same way, you'll want to create different Sharing Sets for each profile. If they share objects via the same fields, then you can add multiple profiles to the same Sharing Set – that's totally acceptable.

Click New to create a new Sharing Set.

So you want to build out the Sharing Set now and add the profile(s) that are being used. If this Sharing Set is for a single profile, I would name the Sharing Set after that profile, if for multiple profiles, then use a name that relates. Make sure that you fill in your description, you want a self documenting org here. What is the use of this Sharing Set, which Community, etc. Short and sweet, but enough to read it and not have to dive in for the details.

Then you add your objects. If you have a large number of objects in your org you'll have to search for some, no need to worry, they stay as you search and update the other object settings.

I have added to my org the Seat and Login version of the Custom: Partner Community profiles I created. I am going to setup the sharing for the Account and Opportunity objects with these two profiles on my Sharing Set.

I have chosen to share Accounts using the Account Contact Relationship object that is used with Contacts to Multiple Accounts. This allows for my Partners to see the Accounts that they are related to as a Contact in the Account Contact Relationship related list for Contacts to Multiple Accounts. They are granted Read Access on these Accounts. This is done by matching the User.Contact.RelatedAccount to the Account.Id

For the Opportunity object, the requirements grant Read/Write access to records to Partners when the User.Contact.AccountId matches the custom field Opportunity.Partner__c. If the User's Account match's this custom Account field then the User can see the record.

Click Save on the Sharing Set and that's all it takes!

Scenarios

I'm going to run through a few scenarios here:

Scenario 1

Object to share: Opportunity

Profile to share with: Executive Partner Community Profile (a custom profile)

Field Used for sharing: Partner__c on the Opportunity Object

This will work by matching the User.Contact.AccountId with the Opportunity.Partner__c

Scenario 2

Object to share: Opportunity

Profile to share with: Executive Partner Community Profile (a custom profile)

Field Used for sharing: Partner_1__c and Partner_2__c on the Opportunity Object

This will not work, you can only share an object with a profile based on one field with a sharing set

Scenario 3

Object to Share: Buildings__c

Profile to share with: Custom: Developer Community Profile (a CC Profile)

Field Used for sharing: Share with all Account__c listed on a child Lease__c object

This will not work, you cannot share based on matching with another object, the field you match has to be on the record you are sharing.

Summary

I hope the idea of using sharing sets and matching user lookup fields and related lookup fields to the lookup fields on a record has given you some ideas about your Community and options for sharing. Now that Sharing Sets are available for all Community Licenses, it is amazing what awesome things can be done.

What are some cool things you have done with Sharing Sets? Any unique problems you have solved? I would love to hear about them.