User sharing to control visibility of other users
Key Takeaway
The organization-wide default for user records is the most restrictive level of access, and the other user sharing tools only open access from there.
User sharing controls which users can see other users in the org, for both internal and external users. It works like record sharing: you set a baseline with the organization-wide default for user records, then you open access for the users who need it. App builders use it when some users, such as partners or customers, should not see everyone in the org.
What access to a user record gives
What you can see about another user depends on your access to that user's record. Without Read access to a user record, you see only the user's name. With Read access, you see the user's name, profile, and detail page, and you can find the user in these places:
- Lookups
- List views
- Ownership changes
- User operations
- Search
Read/Write access on a user record lets internal users edit it, but not fields such as role, profile, or permissions. Portal users can't edit user records at all.