# CRM Analytics user permissions and integration users

*CRM Analytics and Einstein Discovery Consultant Study Guide · Security · Last updated November 3, 2026 · https://www.certifyforce.com/study-guide/crm-analytics-and-einstein-discovery-consultant/security/crm-analytics-user-permissions-and-integration-users*

Which user permission, app access level or system-user setting meets a governance rule: asset permissions such as dashboards, downloads and dataset security, permission set groups with muting, Integration User and Security User field access, column restriction by dataset and app, and Experience Cloud member licensing.

- Certification: Salesforce CRM Analytics and Einstein Discovery Consultant
- Exam section: Security
- Study guide: https://www.certifyforce.com/study-guide/crm-analytics-and-einstein-discovery-consultant

**Official exam objective:**

> Given governance and CRM Analytics asset security requirements, implement necessary security settings for users, groups, and profiles.

## What the exam expects

- Pick the narrowest user permission for an asset task and the app access it still needs.
- Use a permission set group with a muting permission set when one team needs a shared set minus a permission.
- Keep a sensitive field out of every dataset through the Integration User, and let a predicate read custom User fields through the Security User.
- Restrict a column for some users with a separate dataset and app.
- State which Experience Cloud users can view embedded dashboards and what they need.

Key terms: **user permission** (what a user can do); **app access** (Viewer, Editor or Manager on the app that holds an asset); **Integration User** (internal user whose permissions extract Salesforce data); **Security User** (internal user that reads the User object when a predicate is evaluated); **muting permission set** (switches off selected permissions inside one permission set group).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Edit dataset name, app or XMD | Use CRM Analytics and Editor access to the dataset's app | [Edit a Dataset](https://help.salesforce.com/s/articleView?id=analytics.bi_dataset_edit.htm&type=5&language=en_US) |
| Edit dataset security | Edit CRM Analytics Dataflows | [Edit a Dataset](https://help.salesforce.com/s/articleView?id=analytics.bi_dataset_edit.htm&type=5&language=en_US) |
| Restore a dataset | Edit CRM Analytics Dataflows (Edit a Dataset) or Manage CRM Analytics (Restore page) | [Edit a Dataset](https://help.salesforce.com/s/articleView?id=analytics.bi_dataset_edit.htm&type=5&language=en_US), [Restore a Dataset Version](https://help.salesforce.com/s/articleView?id=analytics.bi_integrate_dataset_restore.htm&type=5&language=en_US) |
| Save an existing dashboard | Editor or Manager plus the dashboard permission | [App-Level Sharing](https://help.salesforce.com/s/articleView?id=analytics.bi_app_sharing.htm&type=5&language=en_US) |
| Muting permission sets per group | Up to one | [Muting Permission Sets](https://help.salesforce.com/s/articleView?id=platform.perm_set_groups_muting.htm&type=5&language=en_US) |
| Integration User default | View All Data; a job extracting an unreadable field fails | [Salesforce Data Access](https://help.salesforce.com/s/articleView?id=analytics.bi_security_salesforce_object_field_levels.htm&language=en_US&type=5) |
| Security User default | Reads standard User fields; custom fields need read granted | [Salesforce Data Access](https://help.salesforce.com/s/articleView?id=analytics.bi_security_salesforce_object_field_levels.htm&language=en_US&type=5) |
| Source field-level security | Not preserved in datasets | [CRM Analytics Limitations](https://help.salesforce.com/s/articleView?id=analytics.bi_limitations.htm&language=en_US&type=5) |
| Changing the internal users' access | Clone the profile, edit Read, assign the clone | [Control Access to Objects and Fields](https://help.salesforce.com/s/articleView?id=analytics.bi_security_salesforce_object_field_levels_control_access.htm&language=en_US&type=5) |
| Site users who can view embedded dashboards | Customer Community Plus, Partner Community, Lightning External Apps Plus; no guests | [Share in Experience Cloud Sites](https://help.salesforce.com/s/articleView?id=analytics.bi_app_communities.htm&language=en_US&type=5) |

## Check yourself

- How many muting permission sets can one permission set group contain?
- When must you grant the internal predicate user read on a User field?
- Why does Help ask for discretion before granting the dataflow-editing permission?
- Which permission does the dataset edit page require to restore an earlier dataset version?

## Sources

- [Learn about CRM Analytics Permission Set Licenses and User Permissions](https://help.salesforce.com/s/articleView?id=analytics.bi_setup_user_permissions.htm&language=en_US&type=5)
- [Edit a Dataset](https://help.salesforce.com/s/articleView?id=analytics.bi_dataset_edit.htm&type=5&language=en_US)
- [Restore a Dataset Version](https://help.salesforce.com/s/articleView?id=analytics.bi_integrate_dataset_restore.htm&type=5&language=en_US)
- [App-Level Sharing](https://help.salesforce.com/s/articleView?id=analytics.bi_app_sharing.htm&type=5&language=en_US)
- [Data Prep Access Based on Your User Type](https://help.salesforce.com/s/articleView?id=analytics.bi_integrate_data_prep_data_security.htm&type=5&language=en_US)
- [CRM Analytics Security Implementation Guide](https://help.salesforce.com/s/articleView?id=analytics.bi_security_implementation_guide.htm&type=5&language=en_US)
- [Salesforce Data Access in CRM Analytics](https://help.salesforce.com/s/articleView?id=analytics.bi_security_salesforce_object_field_levels.htm&language=en_US&type=5)
- [Control Access to Salesforce Objects and Fields](https://help.salesforce.com/s/articleView?id=analytics.bi_security_salesforce_object_field_levels_control_access.htm&language=en_US&type=5)
- [Values in a Predicate Expression](https://help.salesforce.com/s/articleView?id=analytics.bi_security_datasets_predicate_values.htm&language=en_US&type=5)
- [Add Row-Level Security with a Security Predicate](https://help.salesforce.com/s/articleView?id=analytics.bi_security_datasets_predicate_considerations.htm&type=5&language=en_US)
- [CRM Analytics Limitations](https://help.salesforce.com/s/articleView?id=analytics.bi_limitations.htm&language=en_US&type=5)
- [Data Security in CRM Analytics (Trailhead)](https://trailhead.salesforce.com/content/learn/modules/wave_enable_setup/wave_think_about_security_and_data_access)
- [Muting Permission Sets](https://help.salesforce.com/s/articleView?id=platform.perm_set_groups_muting.htm&type=5&language=en_US)
- [Share CRM Analytics in Experience Cloud Sites](https://help.salesforce.com/s/articleView?id=analytics.bi_app_communities.htm&language=en_US&type=5)
- [Enable CRM Analytics for Experience Cloud Sites](https://help.salesforce.com/s/articleView?id=analytics.bi_setup_communities_enable.htm&language=en_US&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 10 linked practice questions, and unlimited timed mock exams are included with the CRM Analytics and Einstein Discovery Consultant pack (USD $19): https://www.certifyforce.com/practice-exams