Security Metadata Drift

The data you use in CRM Analytics can come from Salesforce objects and fields. A dataflow job runs, and then you can analyze the resulting dataset. In an ideal world, each object in your dataset would stay in perfect sync with its source object. In the real world, the correctness of an object is only as good as the last update. The longer the time between updates, the greater the likelihood of drift. The security metadata (predicates and descriptors) of a Salesforce object is subject to the same risk of drift.

Data drift is inevitable in any system that uses batch updates. Whether security drift affects your dataset depends on many factors: how often security permissions change, how often your dataflow runs, how sharing is configured, and whether your users have a range of security permissions.

For example, if you replicate an Opportunity record in CRM Analytics and then remove a sharing permission for a user on that record in Salesforce, your change doesn’t affect the copy in CRM Analytics until the next full sync. An incremental sync isn’t sufficient because changing only a sharing permission isn’t considered to be a change to the record.

(However, if you remove the same user from a group that controls the same sharing permission, your change is effective immediately — another good argument for using groups to define security.)

A user who has “View All Data” permission (or a user who has access to only a few thousand records) likely experiences little to no drift. But just because an administrator can see a given record (thanks to “View All Data”) doesn’t mean that a user who experiences drift can see the same record.

The question that you must answer for each of your datasets is whether drift is a reasonable tradeoff for being able to inherit security metadata.

The only way to be certain that security metadata is up to date is to run full extracts as often as possible. Consider enabling periodic full sync.