Simplifying Access Setup with a Scalable Salesforce Security Model

Executive Summary

A large commercial services organization needed a scalable framework to manage Salesforce access for its 1500 users. With numerous divisions, branches, and staffing models across the company, the original approach of utilizing Profiles had become unmanageable with constant adjustments to Profiles and the creation of new, inconsistent, and duplicate custom Permission Sets. MRE Consulting rearchitected the security model so access could be assigned as modular, reusable building blocks based on what each employee needed to do. The new approach reduced new-user setup time by approximately 80%, improved security configuration accuracy, and gave the support team a more sustainable way to quickly setup and manage user access for more than 1,500 Salesforce users with varied personas across the company’s many branches.

Technologies Implemented: Salesforce Security Model

Challenge

The client operates two primary business divisions in Salesforce. One division leverages Salesforce Field Service to manage field operations, while the other division does not.  Both divisions include numerous branch offices that vary in size, structure, and operational needs.

A large branch may have an employee dedicated to a single role while smaller branches rely on an employee to perform a mix of multiple roles. These hybrid users needed Salesforce access that was tailored to their specific responsibilities.

The client’s original Salesforce security model was designed primarily around Profiles which control functional permissions of what a user can do. Profiles work best for organizations that have consistently defined roles and job functions that rarely change. This model did not provide the flexibility required to accommodate the organization’s diverse personas and responsibilities.

This created several challenges:

• The support team was continuously modifying existing Profiles or creating new Permission Sets.
• Similar users could be configured differently due to fit-for-purpose security set ups.
• User access didn’t always match actual responsibilities – users could receive too much access in some areas or not enough in others.

Business and technical changes created duplication of permissions that were assigned to some users, but not others. With their Salesforce user population expanding beyond 1,500 employees, security maintenance was become increasingly confusing, inefficient and unmaintainable.  This represented growing business risk. The organization needed to streamline its security framework.

Solution

MRE Consulting architected a new Salesforce security model centered around a specific persona’s access. Instead of attempting to represent every type of user through a separate Profile, the new model utilizes Permission Sets and Permission Set Groups that can be assigned individually or combined to meet the exact access that a user needs for their specific job.

By shifting focus to Permission Sets & Permission Set Groups, the support team now had the flexibility to easily configure users to match the structure of each branch and access needs.

For security administration, business roles were mapped to standard personas which represented a bundle of Permission Sets. This helped eliminate inconsistencies with user security and streamlined security maintenance, saving time, and decreasing risk of granting too much access. It also provided an architecture to support the organization’s business strategy of growth through acquisition.

Results

The transition to the new security model was seamless for the existing 1,500 users and was well received by the Salesforce Support Team. It has delivered significant improvements in both efficiency and operational consistency.

• Best-Practice Foundation: Applied Salesforce security best practices and architecture expertise to create a scalable model capable of evolving with the client’s future growth and changing business needs.
• Improved User Provisioning Efficiency: The time required to set up new users has been reduced by approximately 80%
• Consistent and Accurate: Standardized process delivered consistency and accuracy of user access set up
• Flexible User Configuration: Support personnel can now easily and incrementally add specific functionality to hybrid users, providing greater flexibility while maintaining appropriate access controls.
• Standardized User Onboarding: Confusion surrounding the configuration of users within standard persona roles has been effectively eliminated, making the onboarding process consistent, straightforward, and repeatable.
• Project Delivery: The implementation was successfully completed on time and within budget, meeting the established project objectives and delivering measurable operational value.