Security / Permission Set Setup

Created by Mike Johnson, Modified on Sat, Jun 7 at 2:40 AM by Mike Johnson

Permission Sets

DMM Admin/Power User

Grants full access to all Dynamic Milestone Manager features, including creating and managing Templates, Trackers, Milestones, Key Fields, and all related configuration. Admins can view and modify all records, manage sharing rules, and access all reports.

DMM Private User

Designed for organizations using strict security models with OWD = Private. Grants object-level access to key DMM components but relies entirely on Salesforce sharing rules or Apex sharing for record visibility. Users can view and manage only the records explicitly shared with them.

DMM Read-Only User

Provides view-only access to all DMM records and reports. Read-Only users can monitor progress but cannot create, edit, or delete any records. Ideal for supervisors, stakeholders, or auditors.

DMM Basic User

Grants permissions to create and edit DMM Templates. Also allows access to view Activity Trackers and Milestones they own. Can manage their related data but cannot access system configuration, global sharing logic, or restricted reports.

Dynamic Milestone Manager (DMM): User Access Made Simple

Whether you're leading the charge, contributing to key milestones, or just keeping an eye on progress: the Dynamic Milestone Manager gives you tools to bring structure and clarity to your Salesforce processes. The only thing you need to get started? The right permission set.

Here’s your friendly roadmap.

Which Permission Set Should You Assign?

Permission Set	Who It’s For	What They Can Do
DMM Admin / Power User	System Admins, Power Users	Full access. Can create/manage Templates, Milestones, Key Fields, Trackers, reports.
DMM Basic User	Everyday users who build or manage their own work	Can create Templates, manage their own Milestones, and see their Activity Trackers.
DMM Private User	Users in orgs with strict data security (OWD=Private)	Limited to what’s shared via rules or Apex. Great for tightly controlled environments.
DMM Read-Only User	Execs, Supervisors, Auditors	View-only access to everything. Perfect for oversight without risk of edits.

How to Assign a Permission Set

Go to Setup in Salesforce.
Search for "Permission Sets."
Select the one that matches the user’s role (see table above).
Click Manage Assignments, then Add Assignments, and select the user.

What If We Use Professional Edition (ProSuite)?

ProSuite does not support permission sets. But your team can still use DMM by assigning access through profiles instead.

Here’s how to make it work:

Create custom Profiles (i.e. DMM Admin Profile, DMM Viewer Profile).
Manually assign object-level and field-level permissions for each DMM custom object.
Set up record sharing with criteria-based or manual sharing if using OWD = Private.

Tip: See the “DMM Access Matrix” .... a cheat sheet to help you replicate the behavior of each permission set using profiles.

Quick Recommendations

If You Are A...	Start With
New user needing full control	DMM Admin / Power User
Salesforce User managing records	DMM Basic User
Users are in a high-security org	DMM Private User
Executive or auditor	DMM Read-Only User

Dynamic Milestone Manager Access Matrix

Role Type	Permission Set (EE+)	Profile (ProSuite)	Object Access	Milestone/Tracker Access	Can View Reports	Can Access Report Folders	Notes
Admin / Power User	DMM Admin / Power User	Standard System Admin	Full (CRED)	All records	Yes (All Reports)	Yes (All Folders)	Full app + report access
Template Owner	DMM Basic User	Standard User	Create/Edit Own	Own templates, activities	Yes (own/use case)	Limited by folder sharing	Can’t manage global configs
Private Org User	DMM Private User	Standard User (Private OWD)	Limited (Shared Only)	Only what’s shared via Apex/manual	Yes (if shared)	⚠Folder must be shared	Strict access model
Read-Only User	DMM Read-Only User	Read-Only Profile	Read Only	All (read-only)	Yes (Read-Only)	If folder is shared	Oversight-only role
Professional Edition Admin	No permission sets	Standard System Admin	Manual Setup Req.	Manually shared	If profile has access	If folders shared to profile	Must manually assign object/report access
Professional Edition User	No permission sets	Standard User	Manual Setup Req.	Manual sharing required	⚠If shared	⚠Folder must be shared	Manual, profile-based access

Notes:

CRED = Create, Read, Edit, Delete
Report Folder Access is managed separately in Salesforce -> Must be shared with roles, public groups, or users
In ProSuite, folder access must be shared manually: no dynamic sharing via roles or permission sets
Enterprise+ editions can use permission sets to automatically grant access to reports and underlying objects

Recommendations

For ProSuite orgs, pre-create shared folders like:
- "DMM Progress Reports"
- "Tracker Completion Overview"
- Share these folders with “All Internal Users” or specific public groups for visibility.
Consider enabling Manual Sharing in ProSuite (via Salesforce Support) to give more granular record/report access if needed.