Supporting Salesforce-enforced record level security in sFiles

Rather than using SharePoint file sharing rules, sFiles can be configured to utilize Salesforce built-in sharing rules to prevent a user from seeing files related to records they cannot see.

Jul 9, 2024
Knowledge

Title

URL Name

Supporting-Salesforce-enforced-record-level-security-in-sFiles

Article Body

Example:

In Salesforce, Jane has access to all contracts related to the Acme account, but no access to any other contract records. The problem is that all contract files are maintained in a single contracts folder in SharePoint. Jane should be restricted from seeing contract documents related to all other accounts.

Steps:

Configure sFiles to use Named Principal authentication (How to configure sFiles to use Named Principal authentication). (If you have your sFiles set up as Per User, this method will still work. However, if the user opens SharePoint, they will still see the files unless you limit the visibility inside SharePoint Online itself with permissions.)
Configure sharing rules in Salesforce to enforce your planned security rules.
In the Document Library, add a custom column called SalesforceId.
For the object you wish to configure, set the fields in SharePoint Object Settings metadata type as seen here:
- Folder Custom Field Default Value: SalesforceId:[Id]
- Salesforce Object Id Field: SalesforceId

NOTE: ContentVersion Id's are NOT supported for salesforce-enforced record level security. If a ContentVersion Id is entered into the "SalesforceId" column in SharePoint, sFiles will ignore it and the file or folder will be considered as not passing record level security.