Assign Group Access By Country

If you want to provide a group of users with access to data on the basis of the users' context, such as their business units, countries, or regions, then access groups are the best way of providing such access.

This topic gives an example of the high-level steps to follow to assign access to sales objects (for example, accounts, contacts, opportunities, partners, and leads) to groups of resource users on the basis of the users' home countries. You can use a similar process to assign a group with data access using some other attribute, such as resource organization.

To provide users with access to sales records on the basis of their country:

1. Create a custom attribute, Country, for each sales object and make the attribute available as a custom field on the sales object UI.

   When creating or editing an object record, such as an opportunity, the user can then select the country associated with the record from the custom Country field on the UI.

2. Create a custom attribute, Country, for the Resource object to represent a user's country and make the attribute available as a custom field on the Resource object UI.

   When creating users, you can then select the country the user is associated with from the Country field on the UI.

3. On the Access Groups page of the Sales and Service Access Management work area, create an access group for each country and add existing resources to each country group. As new users join your organization, make sure you add them to a country group.

   You can add members to each country-based access group manually on the Access Groups UI. Or, use these steps to add members to access groups using the export and import functionality:

   1. Use the resource export functionality to generate a list of sales resources and filter the generated export file based on the Country field.

   2. Import country groups and members:

      • For each country-based access group, create an import file with values similar to those shown in this table:

        Sample Values for Countries in Import File

        ACCESS_GROUP_NUMBER	NAME	DESCRIPTION	ACTIVE_FLAG
        3788493471	GERMAN REGION	Access group for users in Germany	Y
        3788493472	UK	Access group for users in UK	Y
        3788493473	FRANCE	Access group for users in France	Y

      • To add members to each access group, create an import file of resources with values similar to those shown in this table:

        Sample Values for Resources in Import File

        ACCESS GROUP NUMBER	GROUP_NAME	PARTY_NUMBER	RESOURCE_EMAIL_ADDRESS	PARTY_NAME
        3788493471	GERMAN REGION	2793920203	[e-mail]	Tom Jones
        3788493471	GERMAN REGION	2793920204	[e-mail]	Lisa Jones
        3788493471	GERMAN REGION	2793920205	[e-mail]	Matt Hooper
        3788493471	GERMAN REGION	2793920206	[e-mail]	Jane Smith

4. On the Access Groups page, click the Object Rules tab.

5. To make the Country attribute visible and available for selection on the Object Sharing Rules page, select the Synchronize Custom Objects and Fields item from the Actions menu.

6. When the value of the Last Synchronized field indicates that the synchronize process is finished, select the sales object that you want to assign by country. For example, select Opportunity.

7. Create an individual rule for each country by clicking Create in the Custom Rules region.

   1. In the Conditions region of the Create Rule page, in the Attribute field, select the Country attribute as the value used to assign object records.

   2. In the Action: Assign Access Group region, assign the rule to the relevant country-based access group and select the level of object access to be provided. For example, select Read or Update access.

   3. Click Save and Close from the Actions menu to save the rule.

      The Object Sharing Rules page is displayed.

8. When you have created an object sharing rule for each country, on the Object Sharing Rules page select Publish Rules from the Actions menu to publish all new and changed rules for the object.

9. When the Perform Object Sharing Rule Assignment Processing process next runs, any changes you've made to object record access are applied. If you want to apply the changes immediately, you can run the process manually using the steps outlined in the topic Run the Perform Object Sharing Rule Assignment Process.

   It's a good idea to run the object sharing rule assignment process for an individual record (for each type of object) and confirm the access group rule processing is correct before processing all records for an object.

For additional information about creating custom attributes and making them visible on a UI, see the Configuring Applications Using Application Composer guide. For additional information about importing and exporting data, see the Understanding Import and Export Management for Sales and Fusion Service guide.