This profile and/or permission set has the ability to Modify All Data. Review assigned users and confirm its use cases. Minimizing access to Modify All Data can help keep your org secure.
Step 1: Identify Relevant Profiles and Permission SetsStart by identifying Profiles and Permission Sets with Modify All Data permissions. You can use a tool like Hubbl Diagnostics, or attempt to identify them manually in Salesforce. To review using Hubbl Diagnostics:To review manually in Salesforce:
Step 2: Review if Modify All Data is Required for Profile or Permission SetOnly a limited number of users should require Modify All Data, such as system administrators, and users associated with backup and restore software. Most scenarios do not require Modify All Data. Scenarios where Modify All Data is being misused generally break down into one of two scenarios:
Step 3: Update the Permission
Step 4: Test the ChangesIt's important to test the changes by logging in as a user with the modified profile (or having such a user test) to ensure they can still perform their required tasks without the "Modify All" permission. This will help you identify if any adjustments need to be made.
Note: Be cautious when modifying permissions, especially removing "Modify All" permissions, as it can impact users' ability to perform their jobs. Always communicate changes with the affected users beforehand. Test changes in a sandbox environment prior to deploying to production.
This profile and/or permission set can Modify All Data. Review assigned users and confirm its use cases. Minimizing access to Modify All Data can help keep your org secure.
Step 1: Identify Relevant Profiles and Permission SetsStart by identifying Profiles and Permission Sets with Modify All Data permissions. You can use a tool like Hubbl Diagnostics, or write SOQL queries to find relevant profiles and permission sets.To review using Hubbl Diagnostics:
To review manually using SOQL queries:
For Profiles:
SELECT Id, Name FROM Profile WHERE PermissionsModifyAllData = TRUE
For Permission Sets:
SELECT Id, Name FROM PermissionSet WHERE PermissionsModifyAllData = TRUE AND ProfileId = NULL
Step 2: Review if Modify All Data is Required for Profile or Permission Set
Only a very limited number of users should require Modify All Data, such as system administrators, and users associated with backup and restore software. Most scenarios do not require Modify All Data. Work with your administrator to determine which Profiles and Permission Sets need to be updated.
Step 3: Write Apex Script to Update the Profile Permissions
To mass update profiles and permissions rather than editing individual items in the UI, a script can be created:
// Use the names from the queries in step 1
// A set of Ids could also be used rather than names
Set<String> profileNames = new Set<String>{'ExampleProfile', 'AnotherProfile'};
List<Profile> profilesToUpdate = [SELECT Id FROM Profile WHERE Name IN :profileNames];
for(Profile p : profilesToUpdate) {
p.PermissionsModifyAllData = false;
}
update profilesToUpdate;
// Use the names from the queries in step 1
For Permission Sets simply substitute “PermissionSet” for Profile.
Step 4: Test the Changes
It's important to test the changes by logging in as a user with the modified profile (or having such a user test) to ensure they can still perform their required tasks without the "Modify All" permission. This will help you identify if any adjustments need to be made. Also, run all apex tests and check for failures to determine if the permission changes mean that any test code needs to be updated.
Note: Be cautious when modifying permissions, especially removing "Modify All" permissions, as it can impact users' ability to perform their jobs. Always communicate changes with the affected users beforehand. Test changes in a sandbox environment prior to deploying to production.
