Permission sets and data space access
What each standard Data 360 permission set (Data Cloud Architect, Activation Manager, Activation Specialist, User) can do, why to keep the standard sets, how to migrate assignments, how data spaces and per-space feature permissions scope access, and the org settings enrichments and external org connections need.
Configure Data 360 permissions, permission sets, and organization-wide settings.
~8 min read · 11 practice questions ·
What the exam expects
- Assign the least-privileged standard permission set (Data Cloud Architect, Data Cloud Activation Manager, Data Cloud Activation Specialist or Data Cloud User) for a persona.
- Explain why standard permission sets beat custom ones, when cloning is the right exception, and how to migrate users in bulk with user access policies.
- Scope access with data spaces: associate permission sets, set View or Customize per data space, and fix unavailable feature permissions.
- Configure the org settings that enrichments and external org connections need, including Controlled by Parent access.
Key terms: standard permission set is a Salesforce-maintained Data 360 permission set updated each release; data space is a logical partition of data, metadata and processes; feature permission is View or Customize access to a feature inside one data space; Controlled by Parent lets users see Data 360 data in related lists when they can see the parent record; user access policy grants or revokes permission sets for users matching criteria.
Key facts
- Detail
- Data Cloud Architect set or System Administrator profile
- Detail
- Grants Customize Application; clone and remove it to restrict Setup
- Detail
- Keep data space associations; not updated with new object permissions
- Detail
- Assign Data Cloud One User
- Detail
- Data spaces permission sets (1 per data space) can't be included
- Detail
- Can't be deleted; prefixes can't be modified
- Detail
- Standard sets except Data Cloud Architect
- Detail
- View All Records or Modify All Records on the feature's objects
- Detail
- Data Cloud Salesforce Connector is for the Platform Integration User only
- Detail
- Read, Edit, Delete; Public Read/Write default internal access
Sources for this section (9)
- Create Data 360 Users and Assign Permissionshelp.salesforce.com (opens in a new tab)
- Data 360 Standard Permission Setshelp.salesforce.com (opens in a new tab)
- Custom Permission Sets in Data Cloudhelp.salesforce.com (opens in a new tab)
- Data 360 Limits and Guidelineshelp.salesforce.com (opens in a new tab)
- About Data Spaceshelp.salesforce.com (opens in a new tab)
- Associate a Permission Set with a Data Spacehelp.salesforce.com (opens in a new tab)
- Manage Feature Access for Data Spaceshelp.salesforce.com (opens in a new tab)
- Troubleshooting CRM Connectionshelp.salesforce.com (opens in a new tab)
- Enrich Your Org with 360 Data and Insightshelp.salesforce.com (opens in a new tab)
- Why does Salesforce discourage custom Data 360 permission sets?
- When are the View and Customize feature options unavailable for a data space?
- Which standard set can create activation targets without reaching Data Cloud Setup?
- Why can't a data spaces permission set go in a permission set group?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Data 360 Consultant pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 22 lessons of the Data 360 Consultant guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (11 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams