Data Security: Trailhead Challenge Help

Introduction

This is a help article designed to assist Trailblazers with troubleshooting hands-on challenges for the Data Security module on Trailhead.

Troubleshooting Tips

Here are some of the common issues Trailblazers encounter when completing the challenges.

Control Access to the Org Unit

In this challenge, you create a System Administrator user with a full Salesforce license and then deactivate it. 

Your Trailhead Playground comes with (2) full Salesforce licenses. If you've already used up both licenses and you try to create the new System Administrator user, it will look like this:

In the User License picklist, notice that the "Salesforce" license is missing from the list. To resolve this, go back to the Users list, and look for the two Salesforce licenses already in use.

In this example, you can see we already have our (2) full licenses in use. Click the Edit link next to one of them, and uncheck the Active box to deactivate the user. Click Save.

Now you'll have a Salesforce license available to complete this challenge.

At any time, you can check what available licenses you have by visiting the Company Information page in Setup. Just enter Company Information in Quick Find, and select Company Information. Scroll to User Licenses to view the licenses available in your Trailhead Playground.

Control Access to Objects Unit

In this challenge, you create a new profile by cloning the existing Minimum Access - Salesforce profile, and then adding additional permissions. Specifically, you'll add Read and Edit permissions for Accounts, Contacts, and Leads. Make sure you check the spelling of the profile name and verify that you haven't added permissions for any other objects. 

Control Access to Fields Unit

In this challenge, you create a new profile by cloning the existing Standard User profile. You remove Delete access on Accounts and Contacts, and remove Read and Edit access for the Account Rating Field. You then create a permission set and add Read and Edit access for the Account Rating field.

There are two ways to remove access to a field. In the unit, we teach you the first way - how to remove field access from the Profile page, under Field-Level Security. Click View and then uncheck the boxes for Read Access and Edit Access to remove access.

You can also remove access through Field Accessibility, by unchecking the Visible box for the field.

Make sure you check the spelling of the profile name and verify that you haven't added permissions for any other objects. 

Control Access to Records Unit

In this challenge, you create a custom object and then set the org-wide default to lock down access to record owners and those above them on the role hierarchy. This is explained verbatim in the unit, but in case you missed it, setting the org-wide default to Private, and checking the box to grant access using hierarchies, will assign access to record owners and those above them in the role hierarchy.

If you've never made a custom object before, check out the Data Modeling module on Trailhead. Be sure you spell the object name and plural label correctly in order to pass this challenge.

Create a Role Hierarchy

In this challenge, you'll create three new roles on the role hierarchy. The Chief Sales Officer reports to the CEO, the Sales Strategy Manager reports to the Chief Sales Officer, and the Training Coordinator reports to the Sales Strategy Manager. Make sure you check your spelling for each role name.

Define Sharing Rules

In this challenge, you'll use the custom Project object and Training Coordinator role you created in previous units in the Data Security module. If you didn't complete the units in order, go back and finish the prior units before attempting this challenge.

Create a custom picklist field on the Priority object with values High, Medium, and Low. Make sure you enter the values on separate lines.

When you're creating the picklist, you'll be asked to set field level security and add the field to page layouts. We won't test on this, but go ahead and make the field Visible to all profiles and add it to all the page layouts for the Project object.

Now, make a new sharing rule for the Project object that is criteria-based. When the Priority on a Project record is High, let the Training Coordinator have Read Only access to the record. You'll want to make sure your picklist is set up properly, or you won't be able to set up the sharing rule. 

With sharing in Salesforce, if even one user shouldn't see a record, you must lock down the visibility for the object to the most restrictive setting, and then open access back up with sharing rules. So make sure you have the right org-wide default for the Project object.