Salesforce Permission Auditing: Finding and Reducing Excessive Access

Salesforce's access model is flexible and layered — profiles define baseline access, permission sets and permission set groups add capabilities on top, and sharing rules control which records are visible. A user's effective access is the combination of all of these layers, which can be complex to assess even for a single user and becomes very difficult to manage across an organization of hundreds or thousands.

Manual permission auditing is slow, error-prone, and typically only occurs as a periodic event rather than continuously. In the time between reviews, access can change significantly — particularly in fast-growing organizations where users change roles frequently.

A Salesforce permission audit should specifically look for:

• System Administrators who are no longer active: Dormant admin accounts represent a persistent attack surface
• Users with Modify All Data or View All Data: These permissions bypass object-level security and grant access to every record in the org
• API access for non-technical users: The "API Enabled" permission allows programmatic access; it should be limited to users and accounts that have a technical need for it
• Export report and export object permission combinations: Users with both the ability to create reports and export them represent elevated data exfiltration risk
• Manage Users permission: The ability to create, modify, and reset user accounts should be tightly controlled
• Inactive users with active licenses: Former employees or contractors whose accounts were never deprovisioned

Service accounts and integration users deserve specific attention in a Salesforce permission audit:

• What profiles and permission sets does each service account hold?
• Are those permissions proportional to the integration's functional requirements?
• Is there documentation of what objects and fields each integration actually needs?
• Has any integration been decommissioned, leaving a service account with active access?
• Are service account credentials stored securely and rotated on a defined schedule?

A one-time permission audit provides a snapshot. An ongoing program maintains that state over time:

• Schedule periodic access reviews (quarterly for privileged users, annually for standard users) and document the evidence
• Integrate CRM user provisioning with HR lifecycle processes so that departures and role changes trigger automatic access review
• Set up continuous monitoring for specific high-risk permission grants (Modify All Data, Manage Users) to alert when these are assigned
• Review connected app authorizations as part of the periodic access review, not just user accounts