Configuration drift is one of the most common — and least visible — security risks in CRM environments. Organizations implement Salesforce, Dynamics 365, or HubSpot carefully, but configuration changes accumulate over time in ways that gradually erode the original security posture.
Here are eight configuration risks that appear frequently in CRM security assessments.
1. Inactive privileged users
System Administrators who have been promoted, reassigned, or departed often retain their CRM administrator privileges long after those privileges are no longer needed. Dormant privileged accounts are a persistent attack surface — if the account is compromised, the attacker has immediate admin access.
2. Shared service account credentials
Multiple integrations or team members sharing a single set of API credentials makes it impossible to attribute activity to a specific entity. When something goes wrong, you cannot determine which system or person was responsible.
3. API access for accounts that don't need it
In Salesforce, profiles and permission sets can include API access even for users who work exclusively through the web interface. This widens the attack surface — a compromised credential for a non-technical user can be used for programmatic data extraction.
4. Sandbox environments with production data
Sandboxes created from production orgs often contain real customer data, which is then accessible to developers and administrators who would not normally have access to production records. If sandbox security controls are weaker than production, this represents a significant exposure.
5. Overly broad sharing rules
Sharing rules that grant visibility to all users, large public groups, or entire roles can expose records far more broadly than intended. These rules are often created for specific use cases and then forgotten, while the organization's structure evolves around them.
6. Connected apps with missing session policies
Salesforce connected apps can be configured with IP range restrictions, session policies, and OAuth flow restrictions. Many connected apps in production environments have these controls disabled or set to permissive defaults.
7. Audit log retention below regulatory minimums
Salesforce's default audit log retention period may be insufficient for regulatory frameworks that require longer retention. Organizations subject to GDPR, SOC 2, or financial services regulation often have specific evidence retention requirements that are not met by default CRM configuration.
8. Missing MFA for privileged users
Multi-factor authentication requirements are not always enforced uniformly. System Administrators, integration users, and users with elevated data access represent the highest risk if their credentials are compromised — but MFA enforcement gaps for these users appear regularly in CRM security assessments.