User permissions in Schoolworks are controlled by their license type, user profile and permission sets.
License Types
Their license type broadly determines whether they have Systems Administrator access to the setup and deep configuration settings, or general access to Schoolworks as a user.
There are two licence types - Salesforce and Salesforce Platform.
The Salesforce license is for Systems Admininstrators only, and grants the user complete access to all areas of the platform. This should be given only to trusted users.
User Profiles
The user profile determines another general level of permissions. The Schoolworks Administrator license grants the user access to all areas in Schoolworks and is the equivalent of the Schoolworks User profile with all of the permission sets added
Permission Sets
There are approximately 50 permissions sets available to add to each user. Permission sets are a granular set of permissions which allow a user usually to view or edit a particular area of Schoolworks.
For example the Enrolment View permission set allows a user access to view the Enrolment screen, but not to perform any edits / changes within it.
The naming of the permission set is reasonably self evident, but as follows:
Adding/removing permission sets
To add or remove a permission set you can do this either via the user record, then navigate to the permission set list and click 'Edit Assignments', OR you can do this via the permission set itself where you can add/remove multiple users to one permission set.
User record
Managing user permissions via permission sets
These are accessible via the permission sets menu option.
Clicking on a permission set will open that permission set - then click 'assign permission set' to assign to users.
Permission Set Groups
A permission set group allows the combination of a number of permission sets which are based on the users job function. When a permission set group is assigned, the user receives the combined permission of all the permission sets in the group. It is possible to have a permission set in more than one group. This saves times as:
- Any changes made to the permission set, update automatically in all groups the permission set is used in.
- Permission Set Groups mean that there is less need to apply individual permission sets to a user, one by one
It is worth reviewing the tasks key staff complete and then the permissions can be grouped based on their job functions.
Creating a New Permission Set Group
- Click setup and in the Quick Find Box on the top left hand side enter Permission Set Groups
- Click on Permission Set Groups and then Click on New Permission Set Group
- Enter a Label and Description and Click Save
Your Permission Set Group will look like this:
To add Permission Sets to the Group click on Permission Sets in Group (circled above)
Click on Add Permission Set and then click on the tick box on the left hand side for those permission required and when complete, click Add.
Roles - controlling access to records
A role hierarchy exists within Schoolworks which allows access to records on an Object based on the job role of the user. For example, the Head of Student Services requires access to all the data used members of the Student Services team, but they have no access to the data owned by their Manager.
So a simple role hierarchy could look like this:
In this example, the School Director has access to all data pertaining to direct reports, plus the data for their team members.
Director Reports have access to the data owned / pertaining to their team, but the teams have no access to the data owned by their managers.
Accessing the role hierarchy
Click Set Up
Type in Roles into the Quick Find / Search box
Click on Roles - this will show you the top line hierarchy which can be expanded or collapsed by clicking on the + or - signs
If you right click on a role, e.g. Finance, it show:
- The role name
- Who the role reports to
- A list of all Users in the Finance Role