Skip to main content
Salesforce access review

Your auditor will ask who can export or delete every Salesforce record. Have that list, signed, before they ask.

A free 19-check PDF from Clientell AI, the AI agent for Salesforce admins, that finds everyone who holds Modify All Data, View All Data, Weekly Data Export or Bulk API Hard Delete. You record who approved each one.

Free printable checklist

Get the checklist (PDF)

Two printable pages. Enter your work email and the PDF opens on this page at once. Free addresses such as Gmail do not work.

We may email you Salesforce admin tips now and then. You can unsubscribe at any time. Privacy policy

Source: Salesforce Best Practices Around IT Compliance for SOX (salesforce.com, PDF).

What you get

  • The Profile, Permission Set or Permission Set Group that gives each user Modify All Data
  • Stale admins: users who still hold Modify All Data but no longer log in
  • Evidence exported before Salesforce ages it out of Setup Audit Trail and login history
  • Sign-off lines for 2 approvers and a next review date for the audit file

Printable checklist

From scope to sign-off, in eight groups. Each check has a pass line and space to write who holds the access and why.

Opens after you enter your work email above

Org access risk quiz

Eight questions on who holds Modify All Data, how often you review it and where you keep proof. You see where the gaps are. It checks your habits, not your org, and runs in your browser.

Take the quiz

The full guide

What each powerful permission does, where to find it in Setup, and the query that lists who holds it. Each point links to its Salesforce Help page.

Read the guide

Do it by hand first

Who holds the riskiest access in your org?

You do not need a tool to start. Each check below uses a Setup page and a query that Salesforce documents. Run the queries with the Salesforce CLI (sf data query -o your-org -q "...") or any SOQL (Salesforce Object Query Language) tool you already use.

Check 1

Who holds Modify All Data?

Setup path: Quick Find box, type Permission Sets, then open Permission Sets. Open a set and click App Permissions or System Permissions to read what it grants.

Salesforce calls Modify All Data "the highest level of data access". It overrides all sharing rules and object-level permissions. The first query lists every active user who holds it, from a profile or a permission set. Profiles show up because each profile keeps its permissions in a permission set it owns (IsOwnedByProfile = true).

SELECT AssigneeId, PermissionSet.Name, PermissionSet.IsOwnedByProfile
FROM PermissionSetAssignment
WHERE PermissionSet.PermissionsModifyAllData = true
AND Assignee.IsActive = true

SELECT PermissionSetGroupId
FROM PermissionSetAssignment
WHERE PermissionSetGroupId IN (
  SELECT PermissionSetGroupId FROM PermissionSetGroupComponent
  WHERE PermissionSet.PermissionsModifyAllData = true
  OR PermissionSet.PermissionsViewAllData = true)
AND Assignee.IsActive = true

Swap PermissionsModifyAllData for PermissionsViewAllData to find who can read every record. The second query finds permission set groups, assigned to active users, that include either permission.

Sources: Modify All Data Permission in Salesforce (Salesforce Help); PermissionSet object reference (Salesforce Developers); PermissionSetAssignment object reference (Salesforce Developers).

Check 2

Who can take data out, or delete it for good?

Setup path: Quick Find box, type Data Export, then open Data Export. See whether a weekly or monthly export is scheduled.

Export Reports lets a user export report data. Weekly Data Export lets a user export all org data as CSV files. By default, Salesforce gives it only to the System Administrator profile. Bulk API Hard Delete lets a user delete records permanently, bypassing the Recycle Bin. It is not on the standard System Administrator profile.

SELECT AssigneeId, PermissionSet.Name
FROM PermissionSetAssignment
WHERE PermissionSet.PermissionsDataExport = true
AND Assignee.IsActive = true

Run it again with PermissionsExportReport, then with PermissionsBulkApiHardDelete. Three short runs show everyone who can export or delete.

Sources: Export Backup Data from Salesforce (Salesforce Help); How to Enable the Bulk API Hard Delete Permission (Salesforce Help); User Profile permission descriptions (Salesforce Help).

Official Salesforce sources

The Salesforce Help and developer pages behind this checklist.

Last updated: October 21, 2026

Questions

What is a Salesforce user access review?

A Salesforce user access review is a regular check of who holds powerful permissions, such as Modify All Data, and whether they still need them. For each holder you record two answers: do they still need it, and who approved it. Kept with dates and signatures, those answers become your audit evidence.

Source: Comparing Security Models (Salesforce Help).

Which Salesforce permissions should an access review cover?

Salesforce treats four permissions as privileged: Customize Application, Manage Users, Modify All Data and View All Data. Start there. Then add the ones that move data out or destroy it: Export Reports, Weekly Data Export and Bulk API Hard Delete.

Sources: Boost Security by Auditing Your Privileged Users with SOQL (Salesforce Developers blog); User Profile permission descriptions (Salesforce Help).

What is the difference between View All Data and Modify All Data?

View All Data lets a user read every record, whatever the sharing settings say. Modify All Data also lets them edit, delete and transfer every record. Both override sharing settings for all objects, so both belong at the top of every review.

Sources: Comparing Security Models (Salesforce Help); Modify All Data Permission in Salesforce (Salesforce Help).

Who can delete records for good in Salesforce?

Bulk API Hard Delete lets a user delete records permanently through the Bulk API, bypassing the Recycle Bin. The standard System Administrator profile does not have it, and you cannot add it there directly. Use a cloned profile or a permission set.

Source: How to Enable the Bulk API Hard Delete Permission (Salesforce Help).

Is Salesforce retiring permissions on profiles?

No. Salesforce planned to end permissions on profiles in Spring '26, then cancelled that in a Help article published 6 June 2026. Profiles still hold permissions today, so your review must check profiles and permission sets. Salesforce still recommends permission sets for access control.

Source: Permissions in Profiles Retirement Cancelled (Salesforce Help, published 6 Jun 2026).

How often should we review access?

On a fixed schedule that your policy sets. Salesforce's own SOX guidance says privileged users, such as Modify All Data holders, should be "reviewed on a set cadence to ensure their access is still appropriate". Agree the cadence with your auditor, write it down, and keep each review as evidence.

Source: Salesforce Best Practices Around IT Compliance for SOX (salesforce.com, PDF).

How long does Salesforce keep access review evidence?

Setup Audit Trail keeps 180 days of Setup changes. Login history stays online for six months, or ten years with Event Monitoring. Export both on the day of each review, so your evidence does not age out before the audit.

Source: Salesforce Best Practices Around IT Compliance for SOX (salesforce.com, PDF).

Want the list without the queries? Ask Clientell AI.

Clientell AI is an AI agent for Salesforce admins. Connect a sandbox or production org, and it reads your org in read-only mode first. Then ask: “Which active users hold Modify All Data or View All Data, and through which permission set?” It lists them. Then it drafts the access changes you choose and shows them to you.

Start in a sandbox. Clientell AI asks before it changes anything in production.

Your checklist comes with a link to the 14-day free trial. No card needed.