19 February 2013

The Permissioner or How I Learned to Mass Assign Permission Sets


People often tell me it's difficult to assign permission sets. It's the exact same assignment model as profile in the fact that, beyond the standard user detail page, there is no other user interface or tool for mass assigning profiles. But profile assignment is also meant to be changed very infrequently whereas permission sets provide more flexibility, therefore it's more likely to need a tool to easily mass assign one or more permission sets to one or more users.

The Permissioner from Arkus, Inc (@arkusinc, @justedelstein @rogermitchell) is meant to accomplish this exact task - to make it easy when assigning one or more permission sets to one or more users. Behind the scenes, the Permissioner uses the same API that most large customers use on a daily basis to handle user provisioning and authorizations. However, the thing I like about this tool is that it makes it incredibly easy to declaratively point-and-click assign or unassign permission sets enmasse.

One of the challenges when assigning a permission set, unlike a profile which represents a user's single functional role within salesforce, is that a permission set may be created for a very specific task with a specific set of users in mind. As a result, the assignment process becomes more interesting.

Often we assume that you've done the work to figure out which permission sets should be assigned to a set of users. But what if you didn't need to do that preparation? What if you could ask a question about your permission sets or users when you actually assigned them?

Lets say your use case is to assign API access to all standard internal users. You could use a tool like the enhanced list views to look up all permission sets that have the API Enabled permission. But with the Permissioner, you can either search for permission sets by name or by permission. As a result, you can search for all permission sets with the API Enabled permission enabled and choose from the resulting list which one would be the best choice to assign.

And rather than creating a custom list view of users that represent all of your standard internal users, you can use the Permissioner to search users based on a profile, role, title, queue, or public group. This enables you to create an ad-hoc list of users that fit your use case perfectly.

Because the Permissioner uses the same API that allows you to import accounts, or create users, you can always use tools like the Dataloader or Workbench to mass assign and unassign permission sets. But if you are like me and are more point-and-click minded, why bother using the API when there's a great tool available for download from the app exchange that will not only perform the same task, but with the ability to do it better than if you had to do the preparation work to figure out which permission sets you want to assign.

Oh, and did I mention its free? I love this tool.

No comments:

Post a Comment