Salesforce Security Guide
j
No Results
Search Tips:
- Please consider misspellings
- Try different search keywords
Set Your Internal Organization-Wide Sharing Defaults
| Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience |
| Available in: Professional, Enterprise, Performance, Unlimited, and Developer Editions |
| User Permissions Needed | |
|---|---|
| To set default sharing access: | Manage Sharing |
Watch how you can restrict access to records owned by other users.
- From Setup, in the Quick Find box, enter Sharing Settings, then select Sharing Settings.
- Click Edit in the Organization-Wide Defaults area.
-
For each object, select the default internal access that you want to use.
You can assign the following access levels for custom objects and most standard objects.
For other access levels available only for specific objects, see Organization-Wide Default Access Settings.
- To disable automatic access using your hierarchies for custom objects, deselect Grant Access Using Hierarchies. You can only deselect this setting for custom objects that don’t have a default access of Controlled by Parent. For more information, see Controlling Access Using Hierarchies in Salesforce Help.
When you update organization-wide defaults, sharing recalculation applies the access changes to your records. If you have a lot of data, the update can take longer. You receive a notification email when the recalculation completes. Refresh the Sharing Settings page to see your changes. You can also monitor the progress of your organization-wide default updates on the Background Jobs page or view recent sharing operations on the View Setup Audit Trail page.
If you increase the default access, such as from Public Read Only to Public Read/Write, your changes take effect immediately. All users get access based on the updated default access. Sharing recalculation is then run asynchronously to ensure that all redundant access from manual or sharing rules is removed. When the default access for contacts is Controlled by Parent and you increase the default access for accounts, opportunities, or cases, the changes take effect after recalculation is run. If you decrease the default access, such as from Public Read/Write to Public Read Only, your changes take effect after recalculation is run.
The organization-wide sharing default setting can’t be changed for some objects or in some scenarios:
- Service contracts are always Private.
- User provisioning requests are always Private.
- If the default access for Account is set to Private, the default access for Opportunity and Case must be set to Private as well. The default access for Contact must be set to Private or Controlled by Parent.
- If you set the organization-wide default on products to a value other than Public Read/Write, and you use custom code or installed a package, unexpected behavior can occur.
- The ability to view or edit a document, report, or dashboard is based on a user’s access to the folder in which it’s stored.
- Users can view forecasts only of users and territories below them in the forecast hierarchy, unless forecast sharing is enabled.
- When a custom object is on the detail side of a master-detail relationship with a standard object, its organization-wide default is set to Controlled by Parent and it’s not editable.
- The organization-wide default settings can’t be changed from private to public for a custom object if Apex code uses the sharing entries associated with that object. For example, if Apex code retrieves the users and groups who have sharing access on a custom object Invoice__c (represented as Invoice__share in the code), you can’t change the object’s organization-wide sharing setting from private to public.