I have a sales rep that was recently let go and their last day will be Aug 31st. Is there a way I can restrict export rights, but still give the user the ability to send things via email in Salesforce, or are those two permissions connected? - Answers - Salesforce Trailblazer Community
Trailblazer Community
Ask Search:
Taryn HudsonTaryn Hudson 

I have a sales rep that was recently let go and their last day will be Aug 31st. Is there a way I can restrict export rights, but still give the user the ability to send things via email in Salesforce, or are those two permissions connected?

Alberto GrossenbacherAlberto Grossenbacher
Hi Taryn,

I believe there is not a straightforward solution to do that. But I would do some of the next:

- Uncheck the "API Enabled" permission at a profile level, so the user won't be able to use Data Loader or another app which needs the API
- Stop sharing all the report folders or unchecking the "Run Reports" or unchecking the "Export Reports" at a profile level
- On the user interface, I would disable the Printable List Views
- I would also don't permit him to sync with outlook or to use the connect for office
- Setup the login hours (set the hours when users can log in) on the user's profile, and the IP addresses from which users can log in
- Revoke the permission of Weekly Data Export 

Also, you can take a look at the Audit Trail. Even though is a tool which focuses on a Developer/Administrator tasks, you can take advantage of the next tracked changes:

- How many records a user emptied from their Recycle Bin and from the org’s Recycle Bin
- Mass delete use, including when a mass delete exceeds the user’s Recycle Bin limit on deleted records
- Data export requests
- Mass transfer use
- Reporting snapshots, including defining, deleting, or changing the source report or target object on a reporting snapshot
- Use of the Data Import Wizard
- Email addresses for any user
- Deleting email attachments sent as links
 
Dave RiesDave Ries
There is a System Permission on a User's Profile called "Export Reports".  It gives a User the ability to Export/Print data from reports.  You could disable this... but it would remove it for every User that has that Profile.

Also - if the Profile has the permission "API Enabled", then the User (if tech savy) could find another way to export data that they have access to.

But even if you turn both of these off.... the User could still Run reports and take screen shots.  So you'd have to remove the ability to Run reports & Dashboards as well... which again... would impact all Users with that Profile.

Bottom line - my opinion on this - is that if you trust the User to continue to email clients and continue to represent the company until Aug 31st, then you should be able to trust them with your data.  But if you don't trust them with your data, then you should deactivate their access immediatly and not let them represent your company any more.  But thats just my opinion.  It's totally a business decision, not a technical one.
Alberto GrossenbacherAlberto Grossenbacher
+1 for Dave answer.