The hidden Salesforce feature that saved me from going mental: Defer Sharing Calculations!

I guess it’s one of those features that you only get to know about when you get into a situation like I have.

I call this a “hidden” feature because it’s one of those features you have to ask to enable through submitting a case at Salesforce Support. And if you Googled hard enough with the right keywords, you could find it. Let’s just say I didn’t for two months!!

Let me tell you my situation:

A couple of months ago our company announced a major reorganisation. As a Salesforce admin, when you hear something like that you just pray to God, that It won’t impact your Role hiërarchy too much  We have had some reorganizations in the past and they went fine, so I didn’t worry too much at the time…but it turned out to be much more complex than I expected!

Just for your info… our organisation has +700 users devided into approximately 50 roles, but with an extra level of complexity that we have some sister companies in the same org for which all data must be completely hidden from other users. So it’s a private sharing model with lots of sharing rules on lots of objects.

The job at hand for this reorganisation is that we had to build a completely new roles structure, review all sharing rules and update all our users to their new roles with new managers. We went from 50 roles to about a 100 and lots of new sharing rules.

So at that time, we planned this carefully, created a new branch in the role hiërarchy next to the current top branche, created the complete new roles structure. Created and tested the new sharingrules in our sandbox. I thought, perfect plan…all I need to do now is export all users in excel, prepare the file with their new RoleId’s and then use dataloader to update all users into their new roles…piece of cake right?

Yeah well, just try that once. Major disappointment! As soon as the dataloader started it kept in processing mode for about 20 minutes and showed me 1 succesfully updated record, 199 errors, en about 600 to go and froze completely!

So I tried and tried again, modifying the batch size to 100, 50, 10, 1 record at a time…just no luck. It kept freezing!

What’s going on? What am I doing wrong here? So I went in the org and just updated a user manually. I would receive an email notifying me when the update was done because the sharing rules had to be recalculated. Ok that’s normal, I’ll wait a bit. 20 minutes later I received the email and it was done succesfully.

I tried some others manually and the big problem was that I had to wait for 20 minutes each time before I could update another user’s role, even manually. So that was what the problem was, because for each update it had to recalculate all the accessrights and sharingrules and if a user had lots of accounts and other records this took a long time and I couldn’t do this in bulk. But wait…, let me make a quick calculation: 750 updates taking 20 minutes each…This would take me a month OMG!!!

I asked around, searched the web (probably no hard enough or not with the right keywords), called some consultants and everybody came to the same conclusion as I… I would have to do this manually and it would take a loooot of time. Meanwhile I would have to make sure to open up almost all sharingrules because if one user was in his new role, he wouldn’t see the records of all the others in the old roles structure! Jeez.

This should be carefully planned, taking exact measures, creating temporary sharingrules (to not disrupt day-to-day activities) and the transitioning would take about a month or maybe even 2.

So we informed the business, that we wouldn’t be able to do this on such a short time (this was last month…) So we would postpone this to this Quarter. Happy New Year me 

Luckily the Christmas holidays came by and I could get some rest before beginning such a huge task 

Why do I say luckily? Well during the past holidays I decided to study for the Salesforce Sales Cloud Consultant exam and going through the study guide, studying the video’s, doing some trailhead excercices, reading the guides and then I stumbled upon this paragraph from the Sharing Architecture Resource:

Defer Sharing Calculations If you have an object that utilizes sharing and has a large volume of records (such as more than two million accounts), and you need to make a bulk change (such as a quarterly realignment requiring a hierarchy change), then there is a feature that can be enabled by Salesforce Support to defer automatic sharing calculations. Natively, every individual change to the role hierarchy, territory hierarchy, groups, sharing rules, user roles, team membership, or ownership of records can initiate automatic sharing calculations. When a bulk change is made, it causes a number of automatic sharing recalculations to begin. By suspending these temporarily, you are able to make the change and then have sharing calculations happen all at once. This is typically a more efficient and better performing method to bulk changes.

This was exactly what I was looking for!! Halelujah! Happy Happy Joy Joy!

I submitted a case to activate this feature and after some commenting back and forth the Defer Sharing Calculations Feature was activated in our Production org and our Full Copy sandbox.

Once activated you’ll have a new link in the setup sidebar, in the security controls section, just below the Sharing Rules and clicking on it will take you to this page:

Necessary permissions to defer sharing calculations:

“Manage Users”
“View Setup and Configuration”
“Manage Sharing Calculation Deferral”

NOTE: The “Managed Sharing Calculation Deferral” profile perm is not selected by default on the Standard Sys Admin profile. This was done deliberately to force customers to make a conscious decision about who should have access to this feature. So you’ll have to create a permissionset with the Manage Sharing Calculation Deferral system permission and only assign this profile to admin users that completely understand how this feature works.

What is Defer Sharing Calculations?

When you make bulk changes to roles, territories, groups, or users, or change ownership of portal accounts, group membership and sharing rules are automatically recalculated to add or remove access as necessary. This feature can suspend the automatic recalculation untill it’s enabled again. Afterwards a full recalculation should be initiated.

How does Defer Sharing Calculations work?

Defer group membership calculation workflow

To suspend or resume group membership calculation:

1. Click Your Name – Setup – Security Controls – Defer Sharing Calculations.
2. In the Group Membership Calculations box, click Suspend.

IMPORTANT: If sharing rule calculations are enabled, suspending group membership calculations also suspends sharing rule calculations. Resuming group membership calculations also requires full sharing rule recalculation.

3. Make your changes to roles, territories, groups, users, or portal account ownership.
4. To enable group membership calculation, click Resume.

Defer sharing rule calculation workflow

To suspend, resume or recalculate sharing rule calculation:

1. Click Your Name – Setup – Security Controls – Defer Sharing Calculations.
2. In the Sharing Rule Calculations box, click Suspend.
3. Make changes to sharing rules, roles, territories, or public groups participating in sharing rules. IMPORTANT: Any changes to sharing rules require a full recalculation.
4. To enable sharing rule calculation, click Resume.
5. Click Recalculate.

IMPORTANT: The organization will be locked for the duration of the sharing rule recalculation and may take a very long time depending on the size of the organization and number of changes. When the sharing rule recalculation is finished, an email is sent to the administrator notifying him/her of the completion. In addition to the completion email, “initiated”, “completed”, and “failure” emails should also be written to the Setup Audit Trail.

When should administrators use Defer Sharing Calculation?

Administrators should plan to suspend/resume sharing calculations during maintenance windows to have minimal impact on users.

Is Defer Sharing Calculation intended to be enabled temporarily or permanently?

When Defer Sharing Calculation is enabled for the customer, it’s intended to be enabled permanently so the customer can manage their org and when to use it.

I actually created this blogpost because if I hadn’t found out that this feature existed the comming months would have been hell for me  And I guess not a lot of people know about it. And even though it’s is published in help & training and it is findable through Google, it was hard to find. You almost have to know the exact name of the feature to have it popup in the search results. Also, this is not a very common situation that you will encounter on a daily basis, not as an admin and not even as a consultant. So my goal is to let everybody know that thias feature exists, that it is free and that it can really save your life