Two new permissions have been added to provide better control over who can add and edit users, roles, and permissions. These two permissions operate independently:
Permission 488: Add / Edit Users, User Roles, and User Division Access
- Controls access to the User Setup screen
- When disabled for a given role, the Users option is hidden from Setup > System menu options to any user assigned to that role.
- Note: Users can still view and edit their own personal user profile when this is disabled.
Permission 489: Add / Edit Roles and Role Permission Access
- Controls access to the Role Setup and Permission Setup screens
- When disabled for a given role, the Roles option and the Permissions option are both hidden from Setup > System menu options to any user assigned to that role.
To ensure uninterrupted access, a one-time script was run to automatically grant both new permissions to all existing roles that already had access to Setup / System (Permission 120).
If you wish to restrict certain roles from editing users, roles, and permissions, you will need to manually remove these new permissions from those roles.