Why You Should Add Custom Permissions to Your #AwesomeAdmin Tool Belt

Hello, #AwesomeAdmins! Today, I’d like to introduce you to custom permissions, a fairly underutilized configuration feature that’s been around since Winter ’15. While this is more heavily used in code, it’s also available for use by admins. In fact, I believe every admin should have this feature in their superpower tool belt.

So, what are custom permissions?

The custom permissions feature lets you define access checks to your apps or processes. Custom permissions can be assigned to users via permission sets or profiles, similar to how you assign user permissions and other access settings.

Custom permissions are commonly used by developers in Apex. For example, if there’s a button on a Visualforce page and only certain users should have access, a custom permission can be referenced. If the user has the custom permission, the button will display.

Boolean hasCustomPermission = FeatureManagement.checkPermission('your_custom_permission_api_name');

Okay, okay, I know I just pasted some code. Let’s break this down together. This code snippet is checking to see if the user has a certain permission. If the attribute hasCustomPermission is set to true, then allow access. Otherwise, access is denied.

Guess what? Custom permissions are not just for developers! Using similar logic as the developer did in the code snippet above, admins can grant access to features and actions when a user has a custom permission. They’re for admins too!

Custom permissions can be used for:

• Validation rules
• Flows
• Component visibility (The possibilities here are endless!)
• Processes
• Dynamic Form configuration

When do I use custom permissions?

• When a validation rule applies to the same profiles/users
• When a validation rule applies to a subset of users
• When you need the ability to grant or deny access to a specific app or process
• When an action only applies to a subset of users or select profiles
• When select data is only available to a subset of users or select profiles
• When access to a component is provided to a subset of users or select profiles
• When access to a process is only provided to a subset of users or select profiles

How do I configure it?

First, you need to create your custom permission. In Setup, search for ‘Custom Permissions’ in the Quick Find box.

Create a new custom permission.

Pro-tip: Be descriptive with the name of your custom permission so it’s clear what it’s for. Don’t forget to provide a description of what the custom permission is intended for. Is it to grant or deny access? This will remind you (yes, you may need a reminder of this later) as well as other team members working in your org.

Next, determine who needs to be given access to this custom permission. Does everyone in a specific profile need this ability? Are only select individuals allowed this access?

If this applies to all users of a profile, you’ll assign the custom permission at the profile level. Every user assigned to the profile will have this custom permission.

If this only applies to select individuals, add this custom permission to a permission set. Find the Custom Permission attribute, then find the custom permission and add it to the permission set. Once you assign the permission set to a user, that user will have this custom permission.

Pro-tip: If the custom permission is the only attribute of the permission set, I recommend you name the permission set the same name as your custom permission. It makes it easier to maintain and assign/remove access later on.

Next, you reference the custom permission in a component. You’ll follow this step whether it’s a validation rule, flow, process, or a component using component visibility.

In a validation rule or formula, under Insert Field, find $Permission, locate your custom permission, and insert. Once inserted, the syntax should look like $Permission.<Custom Permission API name>, such as ‘$Permission.Update_Opp_in_Stage_Closed_Won.’ Then, add the rest of the syntax. It’s that easy.

In Flow, create a Formula resource, find $Permission, then locate and select your custom permission. Once inserted, the syntax should look like $Permission.<Custom Permission API name>, such as ‘$Permission.Update_Opp_in_Stage_Closed_Won.’ Then, add the rest of the syntax you’re checking for — and voila!

In a process, select the type Formula, select System Variables, select Permission, and then locate and select your custom permission. Once inserted, the syntax should look like $Permission.<Custom Permission API name>, such as ‘$Permission.Update_Opp_in_Stage_Closed_Won.’ Then, add the rest of the syntax you’re checking for, and that’s it.

To use with a dynamic action with component visibility, add the action, then add a component visibility filter. Select Advanced as the filter type. Select the field Permissions > Custom Permission > your custom permission. Then, set the operator and value.

Your configuration can now check whether the user has that specific custom permission. And, depending on how you configured it, you can grant or deny that user access to your custom process at a much finer level.

Let us know how you used custom permissions in your org by sharing with us on Twitter @SalesforceAdmns!

Resources

• Salesforce Security Guide: Custom Permissions