Hi everyone,
I need some architectural advice on the best way to handle report and data access for a global team without turning role management into a maintenance nightmare.
- We have report folders separated by countries: Country A Reports, Country B Reports, and Country C Reports.
- In our Role Hierarchy, we have local roles at the bottom (e.g., Sales Rep Country A, Sales Rep Country B) and a high-level corporate role at the top called Global Management.
The Business Requirement:
Product manager users in their Country or Regional Level role complained not being able to access reports with data related to other countries, so we moved them to the
Global Management team for them to be able to see everything. They require full visibility to access records (Accounts, Opportunities) globally, but they also need to open and view the reports inside the local folders of Country A, Country B, and Country C.
The challenge:
We noticed that when we move a user from a local country role up to the
Global Managementrole to give them global record visibility, they immediately lose access to some of the regional reports they could see before, or the reports show up completely empty for them.
My Questions:
- How can we avoid constantly shifting users from one role to another just so they can see cross-country reports while maintaining access to their respective records? What is the cleanest architecture to decouple record visibility from report folder visibility?
- What is the Best Practice in Salesforce to solve this? Should we keep these global users in a specific role and grant them report folder access via a Public Group or a specific Permission Set?
- Why do some reports return empty or give errors to a user right after they are moved to a higher role in the hierarchy? Is it because of dynamic filters in the reports (like "My Team's Records" or "My Role" filters) that break when their branch changes?
Thank you so much for your help!
@Salesforce Administrators & Developers, @Salesforce Administrators and Developers, @APAC Architects, @Data Quality & Management
#Trailhead Challenges #Salesforce Developer #Reports & Dashboards #Solution Architects #Sales Cloud
The behaviour you describe is almost always caused by how the country folders are shared, plus a couple of report settings, and the clean fix is to stop using the role hierarchy for folder access altogether.
Why access disappears after the role move
Report folder sharing does not roll up the hierarchy the way record sharing does. If the Country A folder is shared with the role "Sales Rep Country A" (or "Roles and Subordinates" of a Country A/Regional role), the grant only applies to users in that role (or below it). A user you move up to Global Management is no longer in that branch, so they silently lose Viewer access to the folder even though they now see more records.
Why reports come back empty or error
1. Scope filters that depend on the user's position: "My Team's Opportunities/Accounts", "My Territory's...", or "My Records" only return records owned by the user and their subordinates. From Global Management the subordinates are different, so the result set changes.
2. Filters on role fields, for example "Owner Role equals Sales Rep Country A", or relative filters like "Owner Role = my role", stop matching.
3. Sharing recalculation: after a role change Salesforce recalculates group membership and sharing, which can take a while in large orgs (or be delayed if deferred sharing maintenance is on), so reports can look incomplete for a short time.
4. Errors usually mean the report now lives in a folder the user cannot access, or it references a report type/field the user no longer has permission to see.
Recommended architecture: decouple the three concerns
1. Role = reporting line and record ownership. Keep product managers in the role that reflects their real position (country or regional) and stop moving them.
2. Record visibility = sharing rules or permissions. Give global viewers read access to all Accounts/Opportunities with a permission set that grants "View All" on those objects (or criteria/ownership-based sharing rules to a public group, if you want to limit it by country or record type). This works independently of their role.
3. Folder access = public groups. Create groups such as "Reports - Country A Viewers" and "Reports - Global Viewers", share each country folder with the relevant groups (Viewer access), and put the product managers in the global group. Groups can also contain roles or roles and subordinates, so local teams keep their access automatically.
4. Build cross-country reports with scope "All Accounts/Opportunities" and explicit country filters instead of "My Team's" scopes, so the same report works for everyone and simply returns what the running user can see.
References:
Share a Lightning Report or Dashboard Folder:
https://help.salesforce.com/s/articleView?id=analytics.rd_folders_share_enhanced.htm&type=5Create and Edit Public Groups:
https://help.salesforce.com/s/articleView?id=sf.user_groups_create.htm&type=5Sharing Rules overview:
https://help.salesforce.com/s/articleView?id=sf.security_about_sharing_rules.htm&type=5Trailhead, Data Security (Control Access to Records):
https://trailhead.salesforce.com/content/learn/modules/data_securityAssumption: I am assuming your folders are currently shared with roles (or roles and subordinates) and that the empty reports use "My Team's"-type scopes or role-based filters; if the folders are shared with groups already, please check the report scope and filters of one affected report and share them here.
