Understanding Salesforce Scoping Rules for effective Data Management

Have you heard the term "Scoping Rule" in relation to Salesforce? Do you know what exactly a Scoping Rule is, and how is it used in the Salesforce environment? Let's take a closer look and explore how Salesforce Scoping Rules help optimize workflows, improve efficiency by focusing on relevant records while maintaining access to all necessary data and enhance overall data accessibility and security. This blog also covers the usage, business use cases, setup steps, pros, cons, and best practices for implementing Scoping Rules in Salesforce.

Usages of Scoping Rule

The primary usage of Scoping Rules is to make the data accessibility quicker and easier in Salesforce. Users' access to other records that they occasionally need is not restricted by a scoping restriction. Rather, scoping rules enable your users to concentrate on a single group of records, then adjust their attention or conduct a search to locate a record that is not included in the scoped record set as needed.

Scoping rule is not like the restriction rule, where the restriction rule prevents the user to access certain records, while scoping rule is just to scope for the user to focus on a set of records, so users can still access all other records that they can access according to the sharing rules settings.

Scoping rules are available for custom objects and the account, case, contact, event, lead, opportunity, and task standard objects.

Business Use Case

In a large insurance company, customer service representatives (CSRs) handle inquiries and claims for multiple insurance agencies. Each CSR is assigned to specific agencies based on their expertise. To optimize their workflow and ensure accurate service, CSRs should have targeted visibility into records related to their assigned agencies while still having access to other agencies’ records when needed.

Business Requirements:

• Agency-Specific View
  • CSRs should see only the customer records associated with their assigned agencies
  • Records from other agencies should be filtered out by default to avoid confusion.
• Efficient Customer Service:
  • CSRs need quick access to relevant customer information without manual filtering.
  • Access to other agencies’ records should be available for cross-agency support.

Solution Approach:

• Agency Assignment:
  • Ensure that each customer record (policies, claims, inquiries) is linked to a specific agency.
  • Assign agency information to records based on policy ownership or claim handling
• Scoping Rules Implementation:
  • Utilize Salesforce Scoping Rules to control data visibility
  • Define rules that restrict record visibility based on the CSR’s assigned agency.
• Configuration Steps
  • Create scoping rules for different record types (policies, claims, inquiries).
  • Set the rule criteria to match the record’s agency with the CSR’s assigned agency.
  • Assign the scoping rules to CSR profiles or permission sets.
  • For example:
    • If the policy’s agency matches the CSR’s assigned agency, show it.
    • If the claim’s agency matches the CSR’s assigned agency, display it
• User Experience
  • When a CSR logs into Salesforce:
  • They see only customer records associated with their assigned agency
  • Records from other agencies are hidden by default.
  • CSRs can still access other agencies’ records when assisting colleagues or handling cross-agency cases
• Benefits:
  • Focused Service: CSRs concentrate on their assigned agency’s customers.
  • Reduced Noise: Irrelevant records are filtered out, improving efficiency.
  • Data Security: Scoping rules enforce data access based on agency assignment

By implementing scoping rules, the insurance company ensures efficient customer service while maintaining data security across multiple agencies.

Where Scoping Rules are applied

• List View: Applied in Lightning Experience if Filter by scope is selected.
• Reports: Applied in Lightning Experience if Filter by scope is selected.
• SOQL: Applied, unless a scope other than scopingrule is specified.

Steps to Set Up Scoping Rule

• Access Setup
  • Log in to Salesforce and navigate to the Setup page.
• Object Settings
  • Go to the Object Manager and select the object for which you want to set up the Scoping Rule.
• Criteria Definition
  • Define the criteria for the Scoping Rule, such as the conditions under which data should be visible.
  • There are 2 options under User Criteria
    • Criteria Type = User Criteria
      • This allows you to filter based on fields on User object.
    • Criteria Type = Permission Criteria
      • This allows you to filter based on Custom permission.
        Refer Salesforce article for detailed reference.
  • Select Record Criteria i.e. filter condition using fields on that object.
• Apply the Rule
  • Apply the Scoping Rule to the relevant profiles or users within the organization.

Let’s understand it by step-by-step example

• Consider we have to create a scoping rule for user on Case, so they can quickly access the cases created by active users in list view where case type = ‘Question’.
• Let’s Name our scoping rule as Case Type Question and select user criteria under criteria type.

• Here we will consider records created by active users and under record criteria we will set the Case type field as Question and click save.

Once saved this will look like below make sure is Active is marked as true.

Now let’s traverse to list view on cases and user this newly created scope as filter in list view.

As you can see in below attached snippet without scope filter user is able to see all the open cases

Now let’s see the Filter to “filter by scope” as marked below:

And here, the data gets filter out on fly.

Pros and Cons of Scoping Rules

Pros

• Enhanced Security: Helps in maintaining data security and privacy.
• Customization: Allows for granular control over data visibility.
• Allows admin to control the default records that your users see based on criteria that you select, increasing productivity and personalization.
• We can set up scoping rules for different users in your Salesforce org so they can focus on the records that matter to them.

Cons

• Complexity: Setting up and managing Scoping Rules can be complex and require careful planning if multiple scoping rule is created on same object it just consider the one.
• Potential Errors: Misconfiguration of Scoping Rules can lead to data visibility issues.
• Salesforce doesn’t validate that only one active rule applies for a given user. If you create two active rules, and both rules apply to a given user, only one of the active rules is observed.

Best Practices and Considerations

When implementing Scoping Rules in Salesforce, consider the following best practices:

• Your edition affects how many active rules you can have.
• Create up to two active scoping rules per object in Developer editions.
• Create up to five active scoping rules per object in Performance and Unlimited editions.
• Create only one scoping or restriction rule per object per user. For a given object, only one scoping or restriction rule’s user Criteria field can evaluate to true for a given user.
• Creating a scoping rule for an object impacts only that object and doesn’t affect child objects.
• When you reference the Owner field, you must specify the object type in your syntax. For example, the Owner field on an event object can contain a user or a queue, but queues aren’t supported in scoping rules. So, it’s necessary to specify Owner:User in the recordFilter syntax when the filter allows only users.
• You can reference another object’s field using dot notation in the recordFilter field. You can use only one “dot” (one lookup level from the targetEntity). For example, Owner.UserRoleId.
• These data types are supported in the recordFilter and userCriteria fields
  • boolean
  • date (yyyy-MM-dd)
  • dateTime (yyyy-MM-dd HH:mm:ss)
  • double
  • int
  • reference
  • string
  • time
  • single picklis
• Note
  • Comma-separated ID or string values are supported in the Record Criteria field.
• Including a null or blank value in record criteria isn't supported and can result in unexpected behaviour.
• Don't create rules on Event.IsGroupEvent, which indicates whether the event has invitees.
• Use the Activity Timeline instead of Open Activities or Activity History. If you use Open Activities and Activity History related lists, create rules on task or event objects using fields that are only available on the OpenActivity and ActivityHistory objects
• For list views and reports, you can apply the scope through Metadata API (using the filterScope field on the ListView type and the scope field on the Report type “scope”).
• If you include an ID in your recordFilter or userCriteria field that is specific to your Salesforce org (such as a role, record type, or profile ID), you must modify the ID in the target org if it’s different from the org where the scoping rule was originally created. Keep this consideration in mind when deploying rules between sandboxes or to a production org.
• Using SOQL
• You can use a SOQL operator in record criteria only when creating scoping rules via API.
• Unless you use SOQL, scoping rules support only the EQUALS operator. The AND and OR operators aren’t supported.
• When using the SOQL operator in the record filter, the SELECT statement, including nested SELECT statements, must include USING SCOPE EVERYTHING. USING SCOPE EVERYTHING is the only valid scope clause syntax for scoping rules.
• The SOQL operator doesn't support $User syntax except for $User.Id. Dynamic queries within the SOQL operator aren't supported, including on other user object fields.
• Apart from above below should also be taken into consideration:
• Thorough Planning: Clearly define the criteria for data visibility to avoid unnecessary complexity.
• Testing: Thoroughly test the Scoping Rules to ensure they function as intended.
• Documentation: Maintain detailed documentation of the Scoping Rules for future reference and compliance needs.

Conclusion

In conclusion, understanding and effectively utilizing Scoping Rules in Salesforce is essential for maintaining accessibility and performance Impact as Scoping rules were built to support sharing needs in a performant way. Your data volume and architecture are factors in rule performance.

By following best practices and carefully considering the pros and cons, organizations can leverage Scoping Rules to enhance data governance within the Salesforce environment.

By considering the definition, usages, business use case, steps to set up, pros, cons, best practices, and considerations of Scoping Rules, organizations can maximize the benefits of this crucial feature within Salesforce.